Description

This advisory SUPPLEMENTS the previously released Node.js CVE-2026-111497 advisory and does not replace it. HTTP2Shell (originally called Node2Shell) refers to vulnerabilities grouped under CVE-2026-111497. The vulnerability resides in the decoder of the Brotli library developed by Google (versions 1.0.3 through 1.2.0, patched in 1.0.10 / 1.1.1 / 1.2.1), and Node.js is only one of many pieces of software that embed this Brotli version.

Core takeaway: The Node.js patch (upgraded to 22.23.4 / 24.22.1 / 26.12.1) only patches the bundled Brotli copy located inside Node.js itself. The exact same flaw still exists in the embedded Brotli versions of other components (Bun, Python, Envoy/Istio, .NET...), and each component requires its own separate patch. Therefore, an organization that has upgraded Node.js may still be vulnerable if they continue running these other components at unpatched versions.

  • CVSS Score: 9.2 (CVSS v4.0)

  • Severity: Critical

  • Identifiers: CVE-2026-111497; GHSA-9v8h-qqgm-4m35 (Google Brotli); PYSEC-2026-4322/4323 (Python); Envoy GHSA-3wvj-j6qm-62mr; Istio bulletin

Scope of Impact

Supplementary scope: In addition to Node.js (noted in the previous advisory), the following components also use the vulnerable Brotli library and must be independently reviewed and updated:

  • Google Brotli (Original Library): Versions 1.0.3 to 1.0.9, 1.1.0, 1.2.0 (patched in 1.0.10, 1.1.1, 1.2.1)

  • Bun: Version 1.4.3 and earlier (patched in 1.4.4)

  • Python: PyPI brotli package (patched in 1.2.1) and brotlicffi (patched in 1.2.1.0)

  • Reverse Proxy / Service Mesh: Envoy and Istio when the Brotli decompressor is enabled (Istio patched in 1.31.2, 1.30.6, 1.29.9)

  • .NET and Other Software: .NET (BrotliStream/HttpClient) and tools/libraries embedding Brotli (e.g., SBOM generation tools like cdxgen). Must be identified via SBOMs to avoid missing pre-embedded versions.

Impact

The impact remains the same as the Node.js advisory (RCE, memory leakage, DoS, lateral movement). Additional scope details include:

  • Risk extends beyond Node.js: Any process decompressing untrusted Brotli data using the vulnerable library version can be affected (Python services, .NET, Bun, or proxies/service meshes with Brotli enabled).

  • Blind spots during audits: Pre-embedded Brotli versions inside binaries or Docker images do not appear when checking only operating system packages, making them easily mistaken as patched when they are not.

  • Attack surface on both directions of HTTP sessions (both downloading response decompression and receiving request decompression) applies to all components listed above, not just Node.js.

Mitigation

  • Inventory all Brotli copies across the system using SBOMs/component scanning, including versions embedded in binaries and Docker images, rather than relying solely on OS Brotli packages or CVE-based scanning tools.

  • Update each non-Node.js component: Upgrade Bun to 1.4.4; update Python brotli to 1.2.1 and brotlicffi to 1.2.1.0, then regenerate lockfiles; update Envoy/Istio according to vendor patches (Istio 1.31.2/1.30.6/1.29.9); update .NET and other applications to versions utilizing Brotli 1.0.10/1.1.1/1.2.1.

  • After updating, rebuild and redeploy containers/images and compiled binaries, then restart services to ensure patches are fully implemented (applies to all components, not just Node.js).

  • For Node.js patching and temporary proxy/WAF mitigations: Refer to the previously published CVE-2026-111497 (Node.js) advisory.

References