HTTP2Shell (CVE-2026-111497): Brotli RCE Vulnerability Guide

On 21 October 2026, a critical vulnerability affecting Google's Brotlidecompression library was disclosed, potentially exposing applications tomemory corruption and remote code execution (RCE).

Tracked as CVE-2026-111497, and commonly known as HTTP2Shell or Node2Shell, the vulnerabilitycarries a CVSS v4.0 score of 9.2 (Critical).

Initially identified in Node.js, the vulnerability also affects otherapplications using vulnerable Brotli libraries, including certain Python andBun implementations.

What Is HTTP2Shell?

HTTP2Shell is an out-of-bounds write vulnerability in the Brotlidecoder, which processes compressed data commonly used in web communications.

The vulnerability occurs when the decoder incorrectly handles amalformed block-switch instruction. Instead of rejecting the invalid input, thedecoder continues processing data and writes beyond an internal buffer.

An attacker who can supply specially crafted Brotli-compressed data to avulnerable application may exploit this behaviour.

Successful exploitation could result in:

• Remote Code Execution: Potentially execute malicious code within the affected application's process.
• Information Disclosure: Access sensitive information from application memory.
• Denial of Service: Crash application processes and disrupt availability.

Importantly, HTTP2Shell is not limited to HTTP/2. Any applicationdecompressing untrusted data using an affected Brotli library may be exposed.

Which Versions Are Affected?

The vulnerability affects Google Brotli versions 1.0.3 through 1.2.0,including versions bundled with other software.

The following updates address known affected components:

Unsupported releases should be replaced with supported, patchedversions.

Why Should Businesses BeConcerned?

HTTP2Shell introduces security risks beyond individual applications.

Successful exploitation could disrupt customer-facing services, exposeconfidential information or compromise systems processing business-criticaldata.

Applications using third-party dependencies may also be affected withoutdirectly implementing Brotli decompression.

For organisations, these risks can translate into operational downtime,financial losses, regulatory exposure and reputational damage.

How Can OrganisationsProtect Themselves?

For IT and security teams:

1. Identify applications, servers and dependencies using Brotli.
2. Upgrade affected components to patched versions.
3. Review applications that decompress untrusted HTTP requests or responses.
4. Temporarily disable unnecessary Brotli decompression where feasible.
5. Rescan affected applications to verify remediation.

For business leaders:

1. Request an assessment of exposure across critical applications.
2. Prioritise patching internet-facing systems.
3. Ensure third-party providers address vulnerable dependencies.
4. Implement continuous vulnerability monitoring to identify emerging threats.

Blacklock HTTP2Shell Scanner

Following the disclosure, Blacklock's security engineering teamdeveloped a dedicated HTTP2Shell scanner and deployed it to production.

Customers can now use the Blacklock PTaaS platform to assess theirsystems for potential HTTP2Shell exposure and prioritise remediation.

This follows our recent response to PHP2Shell, where we developed and deployed a dedicated scanner within 24 hours ofdisclosure.

These rapid responses highlight the value of continuous vulnerabilityassessment over relying solely on periodic penetration testing.

Don't wait for your next penetration test to identify criticalvulnerabilities.

Explore Blacklock to learn how continuous security testing helps organisations respond toemerging threats.

Related reading: PHP2Shell:Critical PHP Vulnerabilities Expose Web Servers to Remote Code Execution

‍