Brotli Flaw CVE-2026-111497: How to Check and Patch Node.js, Python and .NET

A memory-corruption bug in Google's Brotli decoder, tracked as CVE-2026-111497, affects Node.js, Bun, Python, .NET, Envoy and other software that unpacks Brotli-compressed data. Fixes began shipping on October 21, 2026, and more arrived through the weekend, including out-of-band .NET updates from Microsoft on October 25.

The flaw has been nicknamed Node2Shell, HTTP2Shell and Broccoli2Shell, which is partly why people are searching for it. The practical question is simpler: does anything you run decode Brotli data from someone else, and is it patched? This guide walks through how to check and what to update.

Key facts at a glance

• What it is: an out-of-bounds write in the Brotli C decoder, versions 1.0.3 through 1.2.0. Fixed upstream releases are 1.0.10, 1.1.1 and 1.2.1.
• Severity: Google, which assigned the CVE, rates it 9.2 (critical) on the CVSS 4.0 scale. Red Hat rates it 8.1 (important) and Microsoft scores it 8.1 (high) for .NET.
• Exploitation: researchers ran their own code on one unpatched Node.js build, but no attacks in the wild have been reported. The US Cybersecurity and Infrastructure Security Agency (CISA) recorded exploitation as "none" in its October 23 assessment.
• Who found it: Khai Tran and Sylvie Mayer of OpenAI's Codex Security team reported it. Node.js credits maintainers Matteo Collina and Antoine du Hamel with the fix.
• The catch: each product ships its own copy of the decoder, so each one needs its own update.

Why this flaw matters now

Brotli is a compression format from Google used across the web to shrink pages, scripts and other traffic. Browsers and servers agree on it through the Content-Encoding: br header. The bug sits in the C code that unpacks a Brotli stream, so it travels into anything that reuses that code.

The Node.js project explained the mechanism in its October 21 advisory. An invalid block switch was treated as a temporary need for more input instead of a permanent format error. The streaming decoder then kept appending bytes to an eight-byte internal buffer, writing past its end. The outcome can be a crash, leaked process memory or, in the worst case, remote code execution.

The fix existed for months before anyone knew it mattered. The change that closes the hole was added to Brotli's source code on February 27, 2026. OpenAI said the root cause was fixed then, but nobody realised it created a security vulnerability, and no Brotli release carried the change until October 21.

OpenAI describes the bug as working in both directions. An unpatched server that accepts compressed uploads could be taken over by a malicious client. An unpatched client that accepts compressed responses could be taken over by a malicious server.

Who is affected

You are exposed only if your software decodes Brotli data that someone else controls. Having Brotli installed is not automatically a problem everywhere, but the details differ by platform.

• Node.js 22.x, 24.x and 26.x before the fixed releases. The built-in fetch() decodes a response sent with Content-Encoding: br, and request-body code such as Express 5 and body-parser 2 unpacks Brotli uploads. A plain Node.js HTTP server does not decode request bodies on its own. Node.js 20.x and older are end of life and will not be fixed.
• Bun 1.4.3 and earlier, through fetch() or node:zlib.
• Python, if the Brotli package (1.2.0 and earlier) or brotlicffi (1.2.0.x and earlier) is installed at all. Popular HTTP clients such as requests, urllib3, httpx and aiohttp then decode Brotli responses automatically, even if your own code never imports Brotli.
• .NET 8, 9 and 10, plus .NET 11 previews before Release Candidate 3, but only when Brotli decoding of untrusted data is switched on. Microsoft says .NET Framework is not affected.
• Envoy and Istio, only where Brotli decompression is configured.
• Go projects using the andybalholm/brotli library before v1.2.7, according to cloud security company Wiz.

Apache's standard mod_brotli and Nginx do not decode Brotli by default. Wiz said its own data show 91% of cloud environments have resources vulnerable to the flaw, and 82% have publicly exposed Node.js instances.

Fixed versions to install

The table below lists the first fixed release in each line, as published by each project.

Envoy 1.36.12 also contains the fix, but that branch is unsupported. Istio's 1.29 line is end of life, so moving to a supported line is the safer choice.

How to check and patch, step by step

1. Check your Node.js version. Run node --version. If it is below 22.23.4, 24.22.1 or 26.12.1 in your release line, update. Node.js has published no workaround, so updating the runtime is the only fix.
2. Check Bun. Run bun --version and upgrade to 1.4.4 or later. Rebuild any compiled executables that bundle Bun.
3. Check Python environments. Run pip show Brotli brotlicffi in each virtual environment and container. Upgrade Brotli to 1.2.1 and brotlicffi to 1.2.1.0, or uninstall both so HTTP clients fall back to gzip and deflate.
4. Check .NET. Run dotnet --list-runtimes and install 8.0.33, 9.0.22 or 10.0.14. Apps on the shared runtime only need the update and a restart. Self-contained and NativeAOT apps must be rebuilt and republished, because the decoder is linked into the executable.
5. Update Linux packages. Debian fixed its brotli package for Debian 13 (trixie) in version 1.1.0-2+deb13u1 on October 23 and for Debian 12 (bookworm) in 1.0.9-2+deb12u1. Amazon Linux 2023 shipped fixed brotli and Node.js 24 packages on October 24. Vendors may backport the fix without changing the upstream version number, so check your distribution's security notice rather than the version alone.
6. Restart and rebuild. A running process keeps the old decoder in memory until it restarts. Rebuild container images and refresh dependency lockfiles, then confirm the running workloads load the patched components.

Not every distribution had finished as of October 26. Ubuntu still listed its brotli and nodejs packages as needing evaluation, and SUSE's Node.js 22 updates for SUSE Linux Enterprise 15 were still in testing.

If you cannot update yet

OpenAI's disclosure and several security firms recommend the same stopgaps for software that has no patch yet.

• Reject incoming requests whose Content-Encoding includes br at the reverse proxy, load balancer or middleware, before any decoder touches the body.
• Turn off automatic Brotli decoding in HTTP clients, and reject Brotli responses before they are decoded.
• Do not rely on headers alone. Removing br from Accept-Encoding does not help by itself, because a server can send Brotli whatever the client asks for.

A web application firewall only goes so far. Vercel, which added firewall rules on the day of disclosure, said those rules do not cover responses that its customers' functions fetch from other servers. For that path, only updating the runtime or library closes the gap.

How to tell if you have been affected

There is no simple indicator of compromise for this bug, and no public exploit has been released. The Imperva Red Team, which coined the Node2Shell name, ran attacker-supplied code on an unmodified Node.js 24.22.0 build for Linux on ARM64. Its exploit took several attempts, was not released and was not tested on other builds. Red Hat said there is no reliable public proof of concept for running code.

That said, a few signals are worth reviewing on internet-facing services:

• Unexpected crashes in Node.js, Bun, Python or .NET processes that handle compressed traffic, especially since October 21.
• Brotli-encoded requests from unusual sources in web server, proxy or firewall logs.
• Odd process behaviour on hosts running unpatched versions, such as new child processes or outbound connections you cannot explain.

Wiz recommends prioritising internet-facing services and workloads that process untrusted compressed data, including indirect and transitive dependencies.

What to do if you find something

If you spot suspicious crashes or activity on an unpatched system, treat it as a possible compromise rather than a routine bug. Isolate the host, preserve logs, and patch before bringing it back. Rotate secrets that the affected process could read, since the bug can expose process memory.

Do not assume your dependency scanner has caught everything. The CVE record names Google's Brotli repository, not the Python packages, and GitHub's advisory still listed no affected package, which is what Dependabot reads. Python advisory entries PYSEC-2026-4322 and PYSEC-2026-4323 were added on October 23, so check installed versions by hand as well.

What the experts say

The severity scores themselves show the debate. Google's 9.2 critical rating reflects the worst case of remote code execution. Microsoft takes a narrower view for .NET: its advisory says an unauthenticated attacker could read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege, and it does not list remote code execution among the outcomes. Microsoft also notes that simply having an affected package installed does not expose an app.

Node.js labels the issue high rather than critical. The common thread across vendors is that the risk depends on configuration, which is why checking whether you decode untrusted Brotli matters as much as the version number.

Takeaways

• Update Node.js first if you run it: 22.23.4, 24.22.1 or 26.12.1 are the fixed releases, and there is no workaround.
• Audit Python environments for Brotli or brotlicffi, because popular HTTP clients decode Brotli automatically once either package is present.
• Restart and rebuild after patching, since running processes and self-contained or containerised apps keep the old decoder.
• Block or disable Brotli decoding where no patch is available yet, and watch your distribution's security notices for pending fixes.
• Check versions manually, because automated scanners may not flag every affected package yet.