Exposure Focus
All verdicts

Evidence as of 2026-11-09 (UTC) · Review by 2026-11-23

HTTP2Shell also Node2Shell, Broccoli2Shell

CVE-2026-111497

Tier 3 · Prioritised

A memory-corruption flaw in the Brotli decoder can let an attacker crash, read from or possibly run code in applications that decompress attacker-supplied Brotli data. CISA lists it as exploited, but no source reviewed reports code execution in the wild. It is rated Tier 3, an editorial call.

This tier is for “Application that decodes untrusted Brotli data”. Other placements are higher or lower; see below.

Remote code executionBreaks: Confidentiality, integrity and availabilitySome facts unconfirmed

Verdict by placement

Your tier depends on where it runs. Find the line that matches your setup.

  • Tier 3

    Application that decodes untrusted Brotli data

    Prioritised: sooner than your normal patching cycle, schedule it. Update every affected runtime and library, rebuild container images and restart processes. If you cannot soon, block Brotli-compressed input first.

    Why Tier 3
    • Reachable by an outsider who can supply Brotli data.
    • Listed in CISA KEV on 2026-10-27 (vendor-stated exploitation; the kind of exploitation is not described).
    • No login needed.
    • Memory corruption that can lead to code execution; a researcher demonstrated it on stock Node.js but needed multiple attempts.
    • Reported attacks are attempts or reconnaissance; what they achieve is treated as at most a crash, an inference.

    Rubric: Reachable. Business impact: critical. Evidence: exploited, but it only achieves a significant outcome, so the critical outcome counts as demonstrated.

    Override: Editorial judgment, not a sourced fact. The rubric gives Tier 2: CISA lists exploitation, but no source reviewed shows attacks achieving code execution, and Imperva's code execution counts as demonstrated only. It is rated Tier 3 because the one demonstrated code execution needed multiple attempts and no source reports code execution in the wild. Zscaler reports reconnaissance and exploitation attempts. Wiz says no self-contained remote exploit for code execution has been publicly confirmed. The call moves up if a reliable public exploit for code execution appears or code execution is reported in the wild.

  • Tier 4

    Only decodes Brotli from sources you control

    Update in your normal cycle. Move up if an outsider could influence that data.

    Why Tier 4
    • An outsider cannot supply the compressed data.

    Rubric: Not reachable from the internet. Routine patching.

  • Tier 4

    Never decodes untrusted Brotli

    No special action. Routine patching.

    Why Tier 4
    • Node.js states the condition for exposure is an attacker supplying Brotli data that the application decompresses.

    Rubric: A vendor-stated exposure condition is false, so this is not exposed. Routine patching.

Does this apply to you?

Does any application you run decompress Brotli data that an outsider can influence?

How to checkCheck Node.js (node --version) against the fixed releases 22.23.4, 24.22.1 and 26.12.1, and look for other products that bundle Google's Brotli decoder: Python's brotli package, other runtimes, proxies and container images. Receiving a Brotli body does not decode it; something in your code or middleware has to call the decoder, so also ask which services decompress request bodies or replies from servers you do not control.

If you cannot tell, answer Yes.

Patch and mitigate

There are 2 ways in. Each option below says which it closes and which it leaves open.

  • AAttacker sends compressed data to your server
  • BYour application unpacks a compressed reply from an attacker-controlled server

  1. Update every affected runtime and library

    Vendor-stated

    AClosedBClosed

    Node.js has released 22.23.4, 24.22.1 and 26.12.1. CISA points to Brotli release v1.2.1 for the library. Other products that bundle the decoder need their own update. Patching one runtime does not fix the others. Rebuild container images and restart every process, or the old code keeps running.

    Effort
    An update, a rebuild and a restart for each affected product.
    Might break
    No breakage is reported. Test first anyway. Old versions of runtimes that are out of support will not get a fix and need upgrading.
    Check it worked, undo, guides
    Check it worked
    Ask the running service, not the image tag. Inside the container run node --version or the equivalent for each runtime, and confirm the process started after the update.
    Undo
    Redeploy the previous image. This reopens the flaw, so put the block below in place first.

  2. Block Brotli-compressed requests at your WAF, proxy or firewall

    Vendor-stated

    AClosed for that appBLeft open

    Microsoft's Azure WAF guidance is a custom rule that blocks requests whose Content-Encoding header contains br. Imperva has added WAF rules for this CVE and Fastly has a virtual patch for it; check whether your own WAF vendor has one. This protects applications behind the WAF but does nothing for replies your application downloads from other servers, so it is a stopgap until you update.

    Effort
    Turn on your vendor's rule or virtual patch, or add one header rule that covers every application behind the WAF.
    Might break
    Clients that send Brotli-compressed uploads will be rejected. Azure suggests starting in log-only mode and checking the logs for legitimate compressed uploads before blocking.
    Check it worked, undo, guides
    Check it worked
    Send a harmless request with a Content-Encoding: br header and confirm the WAF logs or rejects it. Then confirm the rule applies to every hostname that serves your applications.
    Undo
    Disable the rule or virtual patch. Its log shows which clients it blocked.

The detail behind this call

Evidence

8 items, as of 2026-11-09
CISA KEV · Vendor-stated
Listed in the Known Exploited Vulnerabilities catalog as a Google Brotli unchecked return value flaw. Added 2026-10-27, federal due date 2026-11-10. CISA's description says a remote, unauthenticated attacker can use a crafted Brotli stream to corrupt decoder memory, leak memory, cause denial of service, or possibly execute code.
As of 2026-11-09 · Source for CISA KEV
Vendor advisory · Vendor-stated
Node.js: malformed compressed input can write past the end of an internal decoder buffer, leading to a crash, disclosure of process memory or remote code execution. Affects 26.x, 24.x and 22.x; fixed in 22.23.4, 24.22.1 and 26.12.1. Node.js labels it high.
As of 2026-11-09 · Source for Vendor advisory
Exploit evidence · Reported, not yet confirmed
BleepingComputer reports CISA confirmed attackers have begun exploiting it. The article gives no detail on who, how widely or what the attackers achieved, and does not say whether public exploit code exists.
As of 2026-11-09 · Source for Exploit evidence
Research proof of concept · Reported, not yet confirmed
Imperva reports a proof of concept that ran code carried in a Brotli response or request body on the official Node.js 24.22.0 Linux arm64 image, with no debugger or instrumented binary. It says the proof did not succeed on every attempt and execution took multiple attempts in their setup. It tested only the listed Linux arm64 builds and application setups. Node.js 24.22.1 rejected the same inputs.
As of 2026-11-09 · Source for Research proof of concept
Public exploit code · Reported, not yet confirmed
Wiz states multiple public proof-of-concept repositories on GitHub demonstrate denial of service and memory corruption, that one demonstrates local code execution while requiring a deterministic memory layout, and that no self-contained remote RCE exploit has been publicly confirmed. Those repositories were not inspected. BleepingComputer separately says proof-of-concept exploits have been published.
As of 2026-11-09 · Source for Public exploit code
Observed attacker activity · Reported, not yet confirmed
Zscaler ThreatLabz reports its deception systems recorded reconnaissance and exploitation attempts after disclosure (40% reconnaissance, 60% exploitation attempts). The post does not report confirmed code execution; it lists crashes only as indicators to monitor. Aikido cited The Hacker News reporting no exploitation in the wild as of October 22, before CISA's listing. No source reviewed reports code execution achieved in the wild.
As of 2026-11-09 · Source for Observed attacker activity
Cause of the flaw · Vendor-stated
Node.js says an invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer. Node.js does not say how reliable code execution is.
As of 2026-11-09 · Source for Cause of the flaw
Vendor report · Reported, not yet confirmed
Sophos describes a critical buffer overflow rated 9.2. The score's version and assigner are not confirmed; it is shown for reference only.
As of 2026-11-09 · Source for Vendor report

Any CVSS (Common Vulnerability Scoring System, a general severity score) figure quoted is for reference. It did not set a tier.

Analysis

The "HTTP2" in the name is misleading: the flaw is in the shared Brotli decoder and has nothing to do with the HTTP/2 protocol. That is why one patch is not enough.

Affected Brotli library versions and the CVSS vector are not stated here. The Node.js advisory and the CISA catalogue entry are the main sources.

Why this call is calmer than CISA's

This section is an editorial judgment. It is not a sourced fact, and it overrides the rubric's Tier 2.

  • CISA lists the flaw as exploited without saying what attackers achieved.
  • Zscaler reports reconnaissance and exploitation attempts, not confirmed code execution.
  • Imperva demonstrated code execution on stock Node.js 24.22.0 (Linux arm64), but only after multiple attempts.
  • Wiz says the one public code-execution proof of concept is local and needs a deterministic memory layout, and that no self-contained remote exploit has been publicly confirmed.
  • No source reviewed reports code execution in the wild. That is not proof there has been none.

The call moves up if a reliable public exploit for code execution appears or code execution is reported in the wild.

Sources

12