HTTP2Shell Brotli flaw: what to patch first

Microsoft, Node.js and Google have fixes out and proof-of-concept code is public. Updating the operating system's Brotli library does not fix most of the copies that matter.

Microsoft shipped out-of-band .NET updates on October 25 for CVE-2026-111497, a memory flaw in Google's Brotli decompression library that researchers have nicknamed HTTP2Shell, Node2Shell and Broccoli2Shell. Node.js and Google released fixes on October 21. Despite the name, HTTP/2 is not the issue: any program that decompresses Brotli data an attacker controls can be crashed, made to leak memory, or in some cases made to run the attacker's code.

The problem for IT teams is where Brotli lives. It is compiled into runtimes, proxies, browsers, monitoring agents and desktop tools, and most of those carry a private copy. BleepingComputer warns that a system-level Brotli update leaves Node.js, and any other app with its own copy, exposed. A server can show a patched libbrotli package and still run a vulnerable decoder in every Node.js process on it.

How serious it is

Upstream Brotli 1.0.3 through 1.2.0 is affected; the fixed releases are 1.0.10, 1.1.1 and 1.2.1. Singapore's Cyber Security Agency rates it 9.8 on CVSS 3.1; the CVE record gives 9.2 on CVSS 4.0, according to Strobes.

Imperva ran its own code on the official Node.js 24.22.0 image for Linux arm64, with no debugger or custom build, The Hacker News reports. It took several tries, and the patched 24.22.1 rejected the same data. Proof-of-concept code is public, but no attacks in the wild had been reported when BleepingComputer published on October 26, and Tanium and Strobes said on October 24 that the bug was not in CISA's Known Exploited Vulnerabilities catalog.

There are two ways in. One is inbound: a server that decompresses a Brotli-compressed request body, such as an Express 5 app using its default body parsers. A plain Node.js HTTP server does not do this just by receiving the request. The other is outbound: an application that fetches a URL and decodes a Brotli response from a server the attacker runs. That second route is why a firewall rule is not enough. Vercel added blocking rules for inbound requests on October 21, and The Hacker News notes those rules do not cover responses an application fetches itself.

The patch order

Tanium's guidance ranks exposure, not version numbers: first internet-facing Express 5 services, then anything that fetches URLs supplied by users, then Node.js lines past end of life.

1. Node.js on servers and in containers

Fixed releases are 22.23.4, 24.22.1 and 26.12.1. Lines 20 and older, 23 and 25 are end of life and get no fix, so those move to 22, 24 or 26. Check the Node.js version itself: process.versions.brotli still reports 1.1.0 or 1.2.0 on fixed builds, because Node.js applied the fix commit rather than a new Brotli release. Running processes keep the old code until restarted, and container images must be rebuilt.

2. Products that bundle Node.js

These are easy to miss because nobody installed "Node.js." Tanium's table, as of October 24, lists VS Code Server fixed in 1.143.1 and Kibana, which bundles Node.js 24.21.0, with no fix yet. Dynatrace had released patched builds for supported OneAgent versions from 1.325 to 1.347 by October 25 and says its ActiveGate, Managed and Operator components are not affected; agents with automatic updates turned off need a manual update.

3. .NET

Microsoft's fixed releases are 8.0.33, 9.0.22 and 10.0.14, with .NET 11 fixed in Release Candidate 3. Microsoft's KB pages say to install the October 25 update even if the October 13 update is already in place. Windows client machines get it through Microsoft Update; Windows Server gets it through WSUS and the Microsoft Update Catalog; Visual Studio installs update through the Visual Studio Installer. A restart may be needed if the files are in use, and the runtime update does not change NuGet package references inside your applications. Self-contained and NativeAOT apps carry their own runtime, so lilting channel says they must be rebuilt and redeployed. Two points lower the urgency: BleepingComputer reports that a stock .NET or ASP.NET Core install does not decompress Brotli unless the app turns it on, and Microsoft says .NET Framework is not affected, according to lilting channel's October 26 update. Apps that opt in to Brotli, or call its APIs, are the ones exposed.

4. Proxies and service meshes

Envoy is fixed in 1.40.0, 1.39.3, 1.38.6 and 1.37.8, and Istio in 1.31.2 and 1.30.6, per Tanium, for deployments that decompress Brotli.

5. Python clients

The fix is Brotli 1.2.1 or brotlicffi 1.2.1.0. Lilting channel's tests show why this matters: with the vulnerable package installed, urllib3 and requests decoded a Brotli response even when the client had asked for no compression. Without the package, nothing was decoded.

6. Desktops and developer tools

Tanium lists Chrome fixed from version 148 and Firefox in 150 and ESR 140.10 and 115.35. It treats Edge, WebView2 and Electron 42 apps as fixed because they share Chromium's code, though Microsoft and Electron had not confirmed it. Git for Windows bundles its own curl with Brotli: version 2.56.0.windows.4, released October 26, moves to Brotli 1.2.1 according to its release notes, while lilting channel found 1.2.0 in 2.56.0.windows.2 and .3. The curl built into Windows has no Brotli support.

7. Linux packages last, carefully

Tanium reported Ubuntu, RHEL, SUSE and Amazon Linux 2023 still unpatched on October 24, and warns that distributions often backport a fix while keeping the old upstream version number. Compare full package release strings against each vendor's advisory, and remember that the package does not cover statically linked builds such as official Node.js, Bun, Envoy and Electron.

What has no fix yet

As of October 26, the Broccoli2Shell tracker listed DuckDB, ClickHouse, Apache Arrow, 7-Zip-zstd and p7zip as unpatched, lilting channel reports. Vendor answers are uneven. On the 3CX community forum, a customer asked whether 3CX V20 on Debian 12, which ships its own .NET runtime and Brotli code, is affected; the only reply so far came from a partner, not from 3CX.

What IT teams should do

Inventory every copy, not just the package. Tanium suggests searching for node and node.exe processes, libbrotlidec* and brotlidec*.dll files, Python _brotli extensions and System.IO.Compression.Brotli, plus container storage. The npm package called brotli is a different library and not the vulnerable one.
Patch internet-facing Node.js services and anything that fetches user-supplied URLs first, then restart processes and rebuild container images.
Approve the October 25 .NET updates in WSUS or your patch tool, and find which in-house apps turn on Brotli decompression.
Ask vendors of agents, appliances and Node.js-based products for their fixed version and date. Kibana and the data tools above had none at last check.
Push Git for Windows 2.56.0.windows.4 and current browsers to developer and admin machines.
Where you cannot patch yet, reject Content-Encoding: br at the proxy or WAF, set inflate: false in Express 5 if clients do not send compressed bodies (it also rejects gzip), and uninstall optional Python Brotli packages. None of these covers responses your own code fetches.

Brotli CVE-2026-111497: the copies to patch first, from .NET to Git