A critical vulnerability in Google’s Brotli compression library, designated CVE-2026-111497 and dubbed “HTTP2Shell,” has been disclosed to affect multiple programming languages and HTTP-based applications, according to Aikido’s security advisory.
The flaw is an out-of-bounds write in the Brotli decoder affecting versions 1.0.3 through 1.2.0 across all platforms. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, leak sensitive data, crash processes, or potentially execute arbitrary code. The vulnerability carries a CVSS v4.0 score of 9.2, classified as Critical.
The bug causes the Brotli decoder to accept bytes beyond intended limits, allowing overflow of a working buffer and corruption of program memory. This corruption can be weaponized to control program execution. According to the source, OpenAI discovered the vulnerability in February and reported it as working bidirectionally—a malicious client can compromise an unpatched server, and a malicious server can compromise an unpatched client accepting compressed responses.
While the root cause was fixed in Brotli’s source code in February, it was not recognized as a security issue at that time, meaning no release shipped with the fix until now. Every project bundling Brotli must release its own update.
Affected software includes Node.js (all versions running vulnerable Brotli), Python packages like Brotli and brotlicffi, curl, Bun, Envoy, and Istio. HTTP clients including requests, httpx, and aiohttp automatically load Brotli when present. Exposure occurs with Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x.
Patches are available for libbrotli, Python, C++, Node.js, Bun, and Envoy. Specific patched versions include Node.js 22.23.4, 24.22.1, and 26.12.1; libbrotli 1.2.1 or later; Python’s Brotli 1.2.1 or later; and Bun 1.4.4 or later. Apache and Nginx do not decode Brotli by default, reducing exposure.
For systems unable to patch immediately, workarounds include disabling Brotli decoding at reverse proxies or load balancers, removing Brotli dependencies from Python applications where support is optional, and rejecting requests with Brotli Content-Encoding. However, these measures are temporary; systems must upgrade patched components and verify deployment before removing protections.
Key facts
- CVE-2026-111497 affects Brotli versions 1.0.3 through 1.2.0 and enables remote code execution via malicious compressed data
- OpenAI discovered the vulnerability in February; the root cause was fixed in source code but not recognized as a security issue
- Patches are available for Node.js, Python Brotli packages, curl, Bun, Envoy, and Istio
- HTTP clients like requests, httpx, and aiohttp automatically load Brotli when present, creating transitive dependencies
- Temporary workarounds include disabling Brotli decoding at network boundaries or removing optional Brotli dependencies