--- title: "HTTP2Shell: Brotli bug sends Node.js, Python and .NET into patch panic" description: "The HTTP2Shell flaw in the Brotli decoder has set off a chain of emergency patches, from Node.js and Python all the way to Microsoft's .NET. If your app decompresses Brotli data from the outside world, you may be exposed." canonical: https://inyourgeek.com/en/articles/2026-10-26-http2shell-correctifs-d-urgence-pour-la-faille-brotli-de type: article author: "Sébastien Soulier" publisher: "InYourGeek" language: en datePublished: 2026-10-26 dateModified: 2026-10-26 section: "Security" tags: ["brotli", "nodejs", "dotnet", "python"] --- # HTTP2Shell: Brotli bug sends Node.js, Python and .NET into patch panic > The HTTP2Shell flaw in the Brotli decoder has set off a chain of emergency patches, from Node.js and Python all the way to Microsoft's .NET. If your app decompresses Brotli data from the outside world, you may be exposed. October 26, 2026 · Security · 3 min Details of a flaw in the Brotli decoder went public on 22 October, and the patches are still trickling in. On Sunday, Microsoft shipped an emergency security update for .NET. On Monday 26 October, [BleepingComputer took stock](https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/), drawing on the Node.js advisory and a report from security firm Imperva. The vulnerability is tracked as CVE-2026-111497 and goes by three names: HTTP2Shell, Broccoli2Shell and Node2Shell. That's more aliases than a Bond villain. For now, BleepingComputer is our only source, so the severity details below are reported exactly as it presents them. ## An eight-byte buffer that won't stay in its lane Brotli is an open-source lossless compression library, developed and maintained by Google. The bug lives in its decoder, which is written in C. A specially crafted compressed stream triggers an invalid block switch. The decoder should treat that as a fatal format error. Instead, it decides it just needs a bit more data, the software version of “it'll make sense if I keep reading.” In streaming mode it keeps appending bytes to an internal eight-byte buffer, and the writes spill into neighbouring memory. Eight bytes, it turns out, leaves very little room for optimism. According to the Node.js advisory, the consequences range from a crashed process to exposed memory, all the way up to remote code execution. Imperva's report reportedly confirms that last one. For .NET, Microsoft warns that successful exploitation allows elevation of privilege on vulnerable systems. Proofs of concept have been published, but no malicious exploitation has been reported so far. ## The versions to install The library is vulnerable in versions 1.0.3 through 1.0.9, 1.1.0 and 1.2.0. These are the fixed versions: - Brotli (Google): 1.0.10, 1.1.1 and 1.2.1; - Node.js: 22.23.4, 24.22.1 and 26.12.1; - Python Brotli package: 1.2.1; - Python brotlicffi package: 1.2.1.0. The source doesn't say which .NET versions Microsoft's patch covers, so check the vendor's advisory. As for the timeline, the fixes went into Brotli's source code back in February. Stable releases from Node.js and Google only shipped on 21 October, public disclosure followed the next day, and patched PyPI packages have been out since 23 October. February to October comes to roughly one month per byte of buffer. After updating, restart the affected processes, then rebuild and redeploy any affected container images. A patch on disk doesn't help much if the old code is still running in memory. ## Why one library reaches so many places Despite the name, HTTP2Shell isn't specific to HTTP/2. Any application that decompresses attacker-controlled Brotli data can be targeted. The source describes two attack paths. In the first, your application fetches a URL and gets back a booby-trapped compressed HTTP response. In the second, the attacker sends a compressed request straight to a server. That also explains all the names. The flaw was first spotted in Node.js, which bundles Brotli's C decoder. Researchers then found that the same bug could reach other ecosystems. On the Python side, the HTTP clients urllib3[brotli], requests, httpx and aiohttp[speedups] are potentially affected when they rely on a vulnerable Brotli decoder. The nastiest trap is embedded copies. A portal set up to track the flaw warns that updating the system Brotli library protects neither Node.js nor applications that ship their own copy of the library. So you have to check each environment separately. When your package manager says everything's fine, it only means its own copy. ## If the update has to wait If you can't update right away, the advice is to remove Brotli support from your Python applications and block incoming Brotli-compressed requests at the proxy or firewall. The second measure has a limit. It does nothing about malicious HTTP responses, the path that reaches your application when it's the one fetching a URL. Bolting the front door won't help if your app keeps going out to collect parcels from strangers. The fix has been sitting in Brotli's repository since February. Now you have to find out how many copies of the library are hiding in your container images, and unlike the buffer, that number may not stop at eight. ## Sources - [Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches](https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/) — bleepingcomputer.com _Article written with AI assistance from the cited sources, reviewed and approved by a human before publication._ --- Equivalent HTML page : https://inyourgeek.com/en/articles/2026-10-26-http2shell-correctifs-d-urgence-pour-la-faille-brotli-de Published by InYourGeek — https://inyourgeek.com/en/a-propos Method and safeguards : https://inyourgeek.com/en/methode All articles : https://inyourgeek.com/en/archives