HTTP2Shell: The Brotli Flaw Behind the Node.js, Python and PHP Updates (CVE-2026-111497)

If you have seen HTTP2Shell (sometimes written "HTTPS2Shell" or called "Node2Shell") in the news this week, here is the short version: it is not a flaw in HTTP/2 or HTTPS. It is a memory bug in Brotli, the compression library Google created that a huge amount of software uses to shrink web traffic. It is tracked as CVE-2026-111497, and since October 27, 2026 it has been on the U.S. government's list of vulnerabilities attackers are actively using.

Because Brotli is built into Node.js, Python packages, PHP on Windows, proxies, media tools and databases, one bug reaches a long list of software. This post explains what is affected, which versions fix it, and how to check your own systems.

What is HTTP2Shell?

Brotli has two halves: one that compresses data and one that decompresses it. The bug is in the decompressor. When it receives a specially malformed compressed stream, it mishandles an error and keeps writing incoming bytes into a small internal buffer, past its end. Writing outside a buffer can crash the program, leak pieces of its memory, or, in the worst case, let an attacker run their own code.

The danger is wherever a program decompresses Brotli data an attacker can send: a web server that accepts compressed requests, an app that downloads and unpacks compressed responses, a proxy that inspects traffic.

• Reported by: OpenAI's Codex Security team (Khai Tran and Sylvie Mayer), credited in the Node.js advisory.
• Made public: October 21, 2026, in the Node.js security releases.
• Proven: security firm Imperva demonstrated code execution against an official Node.js build in a lab.
• Exploited: CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a federal deadline of November 10, 2026.

Which software is affected, and the fixed versions

PHP is affected in a narrower way. PHP reaches Brotli through its cURL extension when automatic decompression of HTTP responses is turned on. The PHP project rebuilt its Windows downloads (the "-1" versions above). On Linux, PHP uses the system's Brotli, so the fix is the operating system update.

How to check if you are affected

• Node.js: run node --version on every server and in every container image. Anything older than the versions above on lines 22, 24 or 26 needs updating.
• Linux packages: check the installed Brotli version with your package manager (apt list --installed | grep -i brotli on Debian and Ubuntu, rpm -qa | grep -i brotli on Red Hat family systems), then apply updates.
• Python apps: check pip show brotli brotlicffi inside each app's environment.
• Containers: an old image keeps an old Brotli even after the server is patched. Rebuild images and redeploy them.
• Then restart. A patched library only protects processes started after the update.

What to do this week

1. Update Node.js, then restart every Node.js service.
2. Apply operating system updates on Linux servers, so the system Brotli is fixed, and restart the services that use it.
3. Rebuild and redeploy container images.
4. Update PHP on Windows to the "-1" builds, if you run PHP on Windows.
5. Ask the vendors of proxies, appliances and hosted services whether their product uses Brotli and when their fix ships.

If you cannot update right away, keep untrusted compressed data away from the affected software: do not accept Brotli-compressed requests from the internet on services that do not need them.

Why one bug reaches so much software

Modern applications are built from shared parts. A single compression library sits inside programming languages, web servers, databases and media tools, often several times on one server in different versions. When that part has a flaw, every product that copied it in is affected, and each one ships its fix on its own schedule.

The same pattern is behind PHP2Shell, and it is why "we updated" is not the same as "we are patched". We wrote about that in Updated is not the same as patched.

HTTP2Shell questions people are asking

Is HTTP2Shell a vulnerability in HTTP/2 or HTTPS?

No. Despite the name, it is a bug in the Brotli decompression library. HTTP/2 and HTTPS themselves are not broken.

Is HTTP2Shell being exploited?

Yes. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026.

What is the fixed Node.js version for CVE-2026-111497?

22.23.4, 24.22.1 or 26.12.1, depending on your release line. Restart your Node.js processes after updating.

Is PHP affected by HTTP2Shell?

Through its cURL extension when automatic response decompression is on. Windows users should install the rebuilt "-1" releases; on Linux, update the system Brotli package.

Are web browsers affected?

The advisories we checked do not cover browsers. Keep your browser updated and restart it after updates, as always.

The bigger lesson

You cannot patch what you do not know you run. An up-to-date list of what is on each server, in each container and inside each appliance turns a week of searching into an afternoon of updates.

If you want that inventory built and kept current, see our security review and hardening service, or get a tech quote.

Sources: Node.js - October 21, 2026 security releases; Upwind - HTTP2Shell (CVE-2026-111497); Cybersecurity News - PHP Windows builds fix HTTP2Shell; CISA - Known Exploited Vulnerabilities catalog.