HTTP2Shell: the Brotli flaw hitting Node.js and Next.js sites, and how to patch it

One week after PHP2Shell shook the PHP world, the JavaScript side got its own emergency. A critical flaw nicknamed HTTP2Shell (also called Node2Shell and Broccoli2Shell) was found in Brotli, the compression library built into Node.js. If you run a Next.js, Express, Nuxt, Remix or any other Node.js app on your own server, a VPS or in Docker, this one is for you.

What is HTTP2Shell, in plain English?

Brotli is Google's compression format. It shrinks files so websites load faster, and almost every modern server and browser speaks it. Node.js ships its own copy of the Brotli decoder inside node:zlib.

The bug, tracked as CVE-2026-111497, lives in that decoder. A specially crafted compressed stream tricks the decoder into treating a broken block as "I just need more data". It keeps writing incoming bytes into an internal buffer that is only eight bytes long, and spills over into nearby memory. The Node.js team says the result can be a crash, leaked server memory, or remote code execution. Security firm Imperva has confirmed the code-execution path works.

1Attacker crafts dataA tiny, malformed Brotli-compressed payload.

2Your app decompresses itVia an incoming request, or a URL your server fetches.

38-byte buffer overflowsThe decoder keeps appending bytes past the end.

!Crash, leak or takeoverMemory corrupted. Worst case: attacker runs code.

Two ways an attacker gets in

This is what makes HTTP2Shell sneaky. There are two doors, and most people only think about the first:

• Incoming requests. An attacker sends a Brotli-compressed request body straight to your server.
• Outgoing fetches. Your server calls a URL (an image proxy, a webhook, a link preview, an AI agent fetching a page) and the response comes back as poisoned Brotli data.

That second route is why blocking inbound Brotli at the firewall is not enough on its own. The tracking site for the flaw warns that the malicious-response route stays open.

Node.js22.x, 24.x and 26.x before the 21 Oct 2026 security releases

BrotliGoogle Brotli 1.0.3 to 1.0.9, 1.1.0 and 1.2.0

Pythonrequests, httpx, urllib3[brotli], aiohttp[speedups] with a vulnerable decoder

.NETMicrosoft shipped an emergency .NET update on Sunday 25 Oct

Does this affect my Next.js website?

It depends on where it runs:

• Self-hosted (VPS, cPanel Node app, Docker, PM2, Render, Railway, your own server): yes, you need to act. Your app runs on whatever Node.js version you installed.
• Fully managed platforms (for example Vercel or Netlify serverless functions): the platform controls the runtime. Check their status page or changelog, and redeploy so new builds pick up the patched Node.js version.
• Static sites (plain HTML, a static export, a Shopify theme): no Node.js server runs your pages, so this specific bug does not reach them.

The fix: patched versions

• Node.js: 22.23.4, 24.22.1 or 26.12.1
• Google Brotli: 1.0.10, 1.1.1 or 1.2.1
• Python Brotli: 1.2.1 · brotlicffi: 1.2.1.0

Node.js and Google released the stable fixes on 21 October 2026, with public disclosure the next day. Proof-of-concept exploits are public. At the time of writing there were no reports of attacks in the wild, but with PHP2Shell, attacks started within hours of disclosure. Don't wait.

1Check versionRun node -v on the server, not your laptop.

2Upgrade NodeTo 22.23.4, 24.22.1 or 26.12.1.

3Rebuild imagesUpdate the FROM node: tag and redeploy containers.

4RestartOld processes keep the old decoder in memory.

Common mistakes that leave you exposed

• Updating the system Brotli library only. Node.js bundles its own copy, so updating the OS package does not fix Node.
• Not restarting. A running process keeps the vulnerable code until it restarts.
• Forgetting old containers. Docker images pinned to an old node:22 digest stay vulnerable until rebuilt.
• Only blocking inbound Brotli. Your server's own outgoing requests can still receive a poisoned response.

If you truly cannot update today, the advice is to remove Brotli support from Python apps and block Brotli-compressed requests at your proxy or firewall as a stop-gap, then patch as soon as possible.

The bigger picture

October 2026 showed a pattern: deep, decades-old bugs in core building blocks (PHP, Brotli) are being found faster, partly because AI tools now help researchers, and attackers, dig through complex code. The Brotli bug was reported by OpenAI's Codex Security team. For business owners the lesson is simple: "set it and forget it" hosting is over. Someone needs to own updates.

Not sure what your site runs on? Send me the link. I'll tell you if HTTP2Shell or PHP2Shell affects you, patch it, and set up monitoring so the next one doesn't catch you off guard.

Sources: Node.js security releases (21 Oct 2026), BleepingComputer.