A memory-corruption bug in Google's Brotli decompression library, tracked as CVE-2026-111497 (CVE stands for Common Vulnerabilities and Exposures), has forced patches across Node.js, Microsoft's .NET, Python packages and several infrastructure tools in the space of five days. It has been nicknamed Node2Shell and HTTP2Shell in press coverage. The practical question for most teams is not what the bug is but which of their programs carry a copy of Brotli.
What the flaw is
Brotli is a compression format that browsers and web servers use for the Content-Encoding: br header. The bug is an out-of-bounds write in the decoder. According to the Node.js advisory, the decoder treated an invalid block switch as a temporary need for more input instead of a permanent format error. The streaming decoder therefore kept appending bytes to an eight-byte internal buffer and wrote past its end.
Google scores it 9.2 on the CVSS v4.0 (Common Vulnerability Scoring System) scale, which is critical. Microsoft scores its own .NET exposure 8.1 on CVSS v3.1 and rates exploitation "More Likely". The affected Brotli versions are 1.0.3 through 1.2.0. The fixed Brotli releases are 1.0.10, 1.1.1 and 1.2.1, according to SecurityWeek. Node.js credits OpenAI Codex Security for the report.
Fixed versions in one place
| Software | Affected | Update to | Date |
|---|---|---|---|
| Node.js 22.x | yes | 22.23.4 | 21 Oct 2026 |
| Node.js 24.x | yes | 24.22.1 | 21 Oct 2026 |
| Node.js 26.x | yes | 26.12.1 | 21 Oct 2026 |
| Node.js 20 and older, plus end-of-life 21, 23, 25 | no fix | move to a supported line | - |
| .NET 8 | yes | 8.0.33 | 25 Oct 2026 |
| .NET 9 | yes | 9.0.22 | 25 Oct 2026 |
| .NET 10 | yes | 10.0.14 | 25 Oct 2026 |
| .NET 11 | yes | Release Candidate 3 (RC2 users must move) | 25 Oct 2026 |
Python Brotli package |
yes | 1.2.1 | week of 19 Oct |
Python brotlicffi |
yes | 1.2.1.0 | week of 19 Oct |
| Visual Studio 2019, 2022, 2026 and PowerShell 7.4, 7.5, 7.6 | yes | latest servicing update | 25 Oct 2026 |
Bun, Envoy and Istio have also shipped updates, per SecurityWeek. A public tracker cited by the same outlet lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II (the UEFI firmware development kit) as still unpatched, with the caveat that the list is incomplete.
Are attackers using it?
As of 26 October 2026 there are no reports of attacks in the wild, and the CVE does not appear in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities catalog; the catalog file I checked was dated 23 October 2026, so check again before relying on that. The risk is still real. Security firm Imperva demonstrated code execution against the official Node.js 24.22.0 Linux arm64 container image, reading a malicious Brotli response with built-in fetch, and also through an Express app that accepts Brotli request bodies. It has not published the exploit. A public proof of concept exists but reportedly works only against a deliberately weakened build, and some researchers think it is usable only to crash a process.
Where your exposure is
You are exposed when your code decompresses Brotli data an outsider can influence. For Node.js, the advisory names zlib.brotliDecompress, its synchronous form, zlib.createBrotliDecompress, and fetch, which decodes Brotli responses. A server that calls an attacker-controlled URL, or accepts compressed uploads, is the worst case. For .NET, Microsoft lists ASP.NET Core request decompression, HttpClient automatic response decompression and the System.IO.Compression Brotli APIs.
Node.js published no workaround. Upgrading is the only documented fix, and the Node.js advice for the time before you can upgrade is to avoid decompressing untrusted Brotli input with node:zlib.
The same Node.js release fixed nine other bugs, including three high-severity Transport Layer Security (TLS) and Domain Name System (DNS) issues, CVE-2026-105482, CVE-2026-106069 and CVE-2026-105483, so the upgrade is worth doing for those alone.
Checks you can run today
# Node.js: version in use (need 22.23.4, 24.22.1 or 26.12.1 or later in your line)
node --version
# Containers: find images still on older Node
docker ps --format '{{.Image}}' | sort -u
# .NET: runtimes and SDKs installed (need 8.0.33, 9.0.22, 10.0.14)
dotnet --list-runtimes
dotnet --list-sdks
# Python: Brotli bindings (need 1.2.1 / brotlicffi 1.2.1.0)
pip list 2>/dev/null | grep -i brotli
Remember that a container image carries its own Node.js or .NET runtime, so a patched host does not patch the image; rebuild and redeploy. Microsoft also fixed a separate Linux-only local privilege escalation, CVE-2026-114148, in .NET tarballs in the same release; it had no CVSS score when reported.
Set a deadline for the unpatched dependencies
Patching Node.js and .NET covers the common cases. The harder work is finding tools that statically bundle Brotli, such as database engines and archive utilities, and asking each vendor for its status. Put a date on that inventory, and treat any internet-facing service on Node.js 20 or older as a migration task, since no fix is coming for it. Upgrade the Node.js and .NET services that touch external content first, within this week, and review the rest by the end of next week.
