HTTP2Shell is a cross-ecosystem security issue caused by CVE-2026-111497, an out-of-bounds write in Google’s Brotli decoder. Malformed compressed data can corrupt process memory and potentially cause information disclosure, denial of service or remote code execution. Systems need patched Brotli code wherever applications embed, bundle or statically link the decoder; updating the operating system library alone may leave vulnerable copies running.
What is HTTP2Shell, and how does the Brotli flaw work?
HTTP2Shell is a vulnerability exposure pattern in which attacker-controlled Brotli data reaches a decoder affected by CVE-2026-111497. The decoder can write outside an allocated memory region while processing malformed compressed input, potentially causing a crash, disclosing information or enabling remote code execution in the affected process.
The underlying defect is in Google’s native Brotli decoder, not in the HTTP/2 protocol. The HTTP2Shell name appeared as researchers recognized that the same decoder could be reached through multiple HTTP clients, servers and application frameworks, according to JFrog’s October 23, 2026 report.
That distinction matters. A service doesn’t become safe merely because it disables HTTP/2, changes web frameworks or blocks compressed inbound requests. A server-side client can still retrieve a malicious response carrying Content-Encoding: br, then pass the body to a vulnerable decoder.
Google published fixed Brotli releases on October 21, 2026. Affected upstream versions are 1.0.3 through 1.0.9, 1.1.0 and 1.2.0; the corresponding repaired branches are 1.0.10, 1.1.1 and 1.2.1. A vendor-confirmed backport can also be safe even when its displayed version differs.
Which HTTP2Shell versions and platforms need patches?
HTTP2Shell affects software carrying vulnerable Brotli code, including Node.js 22.x, 24.x and 26.x before their October 21, 2026 security releases. Bun 1.4.4, rebuilt PHP Windows packages and patched .NET packages illustrate the broader scope: each ecosystem had to replace its own bundled or referenced decoder.
| Product or branch | Affected release information | Patched release | Publication date |
|---|---|---|---|
| Google Brotli 1.0 branch | 1.0.3–1.0.9 | 1.0.10 | October 21, 2026 |
| Google Brotli 1.1 branch | 1.1.0 | 1.1.1 | October 21, 2026 |
| Google Brotli 1.2 branch | 1.2.0 | 1.2.1 | October 21, 2026 |
| Node.js 22.x | 22.x before 22.23.4 | 22.23.4 | October 21, 2026 |
| Node.js 24.x | 24.x before 24.22.1 | 24.22.1 | October 21, 2026 |
| Node.js 26.x | 26.x before 26.12.1 | 26.12.1 | October 21, 2026 |
| Bun | Releases using the vulnerable bundled decoder | 1.4.4 with Brotli 1.2.1 | October 23, 2026 |
| PHP official Windows builds | 8.5.12, 8.4.27, 8.3.36 and 8.2.35 packages without the -1 rebuild | 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 | October 26, 2026 |
| .NET | Affected .NET 8, 9, 10 and 11-preview packages | Microsoft’s out-of-band patched packages | October 25, 2026 |
The table represents at least 13 named replacement releases or package lines: three upstream Brotli branches, three Node.js lines, one Bun release, four PHP Windows rebuilds and affected .NET package families. That count explains why a single operating system update is an unreliable remediation strategy.
Node.js end-of-life versions shouldn’t be treated as protected because they aren’t named among the maintained patched lines. Microsoft’s October 25, 2026 advisory covered affected .NET 8, 9, 10 and 11-preview packages, while listing .NET Framework as unaffected.
Teams already responding to other urgent flaws, such as the GitLab remote-code-execution vulnerability or the actively exploited Atlassian issue, should track Brotli separately. HTTP2Shell remediation follows dependency instances rather than a single internet-facing product.
Can HTTP2Shell really lead to remote code execution?
CVE-2026-111497 can potentially lead to remote code execution because an out-of-bounds write permits malformed Brotli input to corrupt process memory. JFrog reported on October 22, 2026 that Imperva demonstrated code execution against an official vulnerable Node.js build, but Red Hat had not observed a public, reliable RCE exploit by October 26, 2026.
Red Hat assigned CVE-2026-111497 a CVSS v3.1 score of 8.1 and rated the issue Important on October 26, 2026. Its assessment included high attack complexity, which means turning the memory error into dependable code execution is harder than merely triggering a crash.
Don’t read “high complexity” as “low priority.” Internet-facing fetchers can process untrusted data repeatedly, and memory layouts differ across runtimes, operating systems and compiler configurations. A failed exploitation attempt may still become a denial-of-service event.
The fair assessment is serious but measured: code execution has reportedly been demonstrated in a controlled case, while broad, reliable public exploitation wasn’t confirmed by Red Hat at publication. That’s enough evidence to patch quickly without presenting every vulnerable decoder as already compromised.
How can a malicious Brotli response reach your server?
HTTP2Shell can reach a server when an application fetches attacker-controlled content and automatically decodes a Brotli-compressed response. Likely response-side paths include webhook processors, URL-preview generators, crawlers, reverse proxies and server-side request features. Blocking compressed request bodies does not stop malicious Content-Encoding: br responses from those outbound connections.
In cURL, automatic response decompression is disabled by default, according to its 2026 documentation. Applications can enable it through CURLOPT_ACCEPT_ENCODING, PHP’s CURLOPT_ENCODING or the command-line --compressed option. Reachability also requires the selected libcurl build to support Brotli.
Guzzle’s 2026 documentation says decode_content defaults to true. Actual exposure still depends on the chosen handler and the Brotli capability of its underlying libcurl build. Inspect runtime behavior rather than assuming a framework default proves either vulnerability or safety.
A commonly missed edge case is a trusted application fetching an untrusted URL after a redirect. URL previews, webhook validation and proxy services can follow attacker-controlled destinations, so the dangerous data arrives as a response rather than through the public request parser. Similar trust-boundary mistakes also appear in agent-to-agent security failures.
How do you audit and patch HTTP2Shell?
An HTTP2Shell audit must identify every Brotli decoder inside deployed artifacts, replace vulnerable copies, rebuild bundled software and restart affected processes. Verify the binary or package actually running in production. Package manifests alone can miss static libraries, vendored source, container layers, self-contained executables and transitive dependencies.
Use the following 2026 remediation checklist to cover direct and hidden decoder copies:
- Inventory operating system packages, Node.js runtimes, PHP Windows bundles, container images, compiled executables, language bindings and native libraries that contain Brotli.
- Require Brotli 1.0.10, 1.1.1 or 1.2.1, or obtain written vendor confirmation that a security backport fixes CVE-2026-111497.
- Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 or later, then rebuild and redeploy containers, continuous-integration images and single-executable applications.
- For PHP on Windows, verify that the filename includes 8.5.12-1, 8.4.27-1, 8.3.36-1 or 8.2.35-1. The matching package without
-1lacks the October 26, 2026 dependency rebuild. - Search for
CURLOPT_ACCEPT_ENCODING,CURLOPT_ENCODING,--compressedand Guzzle’sdecode_content, then test which paths accept Brotli responses from attacker-selected hosts. - Generate a build-specific software bill of materials that separates duplicate component instances, records dependency relationships and identifies incomplete dependency graphs as known unknowns.
- Regenerate the software bill of materials after patching, rebuild self-contained artifacts, redeploy them and restart every affected process.
The PHP filename detail is unusually easy to miss. Version 8.4.27-1 uses the same PHP runtime version as 8.4.27; the -1 marks a rebuilt Windows package containing Brotli 1.2.1. In my view, checking only phpversion() is inadequate because it may not expose that packaging difference.
CISA’s 2025 SBOM Minimum Elements guidance calls for dependency relationships and enough component identity to distinguish software instances. For this flaw, duplicate instances are operationally significant: a patched system library and an old decoder embedded in an executable are two separate remediation targets.
Finish with deployment evidence. Record an artifact digest, inspect the decoder within that artifact and confirm the restarted process uses the new build. Emergency-response discipline used for unpatched backup-server flaws applies here too, but HTTP2Shell adds the burden of finding duplicated native dependencies.
HTTP2Shell FAQ
Is HTTP/2 itself vulnerable to HTTP2Shell?
HTTP/2 is not the defective component in HTTP2Shell. CVE-2026-111497 resides in Google’s Brotli decoder and can be reached through software that processes malicious Brotli data, including HTTP clients and servers using different protocol versions.
Does updating libbrotli on Linux fix every affected application?
Updating the system libbrotli does not fix applications that statically link, vendor or embed a vulnerable decoder. Each deployed artifact needs inspection, rebuilding and redeployment where necessary.
Are PHP installations on Linux affected by the Windows rebuild notice?
PHP’s October 26, 2026 package announcement specifically rebuilt official Windows packages with Brotli 1.2.1. Linux exposure depends on the Brotli and cURL libraries supplied or bundled by the relevant distribution, container or application build.
Can disabling Brotli decompression serve as a temporary mitigation?
Disabling automatic Brotli decompression can reduce reachable attack paths when the setting is enforced across every client and server code path. Patching remains preferable because hidden libraries, alternate handlers or newly deployed features can reintroduce decoding.
What CVE number is assigned to HTTP2Shell?
HTTP2Shell refers to exposure from CVE-2026-111497, the out-of-bounds write in Google’s Brotli decoder disclosed in October 2026.