HTTP2Shell (Node2Shell, CVE-2026-111497): the Brotli flaw OpenAI's Codex Security team reported, what's affected and which versions fix it

HTTP2Shell is the name security firm Aikido gave on October 23, 2026, to CVE-2026-111497, a memory-corruption flaw in Google's Brotli decompression library that was first disclosed two days earlier as "Node2Shell." Node.js credits the report to OpenAI's Codex Security team. Because Brotli is bundled into runtimes, proxies and HTTP libraries, the fix has to arrive separately in each one. This security story lists what's affected and what to patch. It's the second critical, AI-found bug in widely used web software in one week, after PHP2Shell.

This story is based on the Node.js October 2026 security release, Google Brotli's release notes, the CVE record and its GitHub advisory, CISA's Known Exploited Vulnerabilities catalog, Envoy's, Istio's, Bun's and Microsoft's .NET advisories, the PyPI pages for Brotli and brotlicffi, and research posts by Aikido and Imperva, checked October 26, 2026.

The short version

• What: an out-of-bounds write in the Brotli decoder, in Brotli 1.0.3 through 1.2.0. Crafted compressed data can crash a process, leak memory or, potentially, run code.
• Fixed in: Brotli 1.2.1, 1.1.1 and 1.0.10; Node.js 22.23.4, 24.22.1 and 26.12.1; and downstream releases listed below.
• Severity: CVSS v4.0 9.2 (critical) in the CVE record; "High" from Node.js.
• Found by: the CVE record, filed by Google, and Node.js credit "OpenAI Codex Security" (Khai Tran and Sylvie Mayer); Envoy credits "OpenAI Security Research."
• Exploited? Not in CISA's Known Exploited Vulnerabilities catalog as of October 26, 2026.

What is HTTP2Shell?

The GitHub advisory, which mirrors the CVE record, describes a buffer overflow in Brotli's decoder (c/dec/decode.c) that lets "a remote unauthenticated attacker" use a crafted Brotli stream to corrupt memory, disclose memory, cause a denial of service "or potentially execute arbitrary code." Node.js disclosed it first, on October 21, so early coverage called it Node2Shell. On October 23, Aikido renamed its tracking "HTTP2Shell," saying the flaw affects "many libraries and applications using HTTP."

The flaw sits in a decompressor, so only code that decodes Brotli is at risk. Aikido notes that Apache's standard mod_brotli compresses but doesn't decode, and that Apache and Nginx don't decode Brotli by default.

Which versions fix CVE-2026-111497?

Last verified: October 26, 2026

Bun's advisory adds that executables built with bun build --compile on an affected version stay vulnerable until they're rebuilt with 1.4.4.

Microsoft's .NET advisory of October 25 rates the flaw High (CVSS 3.1 score 8.1) in .NET and fixes it in runtimes 8.0.33, 9.0.22 and 10.0.14. ASP.NET Core and HttpClient don't decompress Brotli by default, so only apps that turn on Brotli decompression or call APIs such as BrotliStream directly are exposed. .NET Framework isn't affected. Self-contained and NativeAOT apps have to be rebuilt and redeployed, because updating the machine's shared runtime doesn't replace a decoder already built into them.

Node.js 25.x, 23.x, 20.x and older lines are end-of-life and get no fix, according to Aikido. Linux distributions may ship the fix as a backported brotli package without changing the upstream version number, and distribution builds of Node.js can use that system library, so check your vendor's advisory rather than the version string alone.

How do I know if my app is exposed?

Look for places where untrusted Brotli data gets decoded. Aikido's and Imperva's research name the common Node.js paths:

• Incoming requests: Express 5 and body-parser 2.x decompress request bodies sent with Content-Encoding: br. A bare node:http server doesn't.
• Outgoing requests: built-in fetch() decompresses Brotli responses automatically, so a webhook target or any user-supplied URL could send one.
• Direct use: passing untrusted input to node:zlib's Brotli functions.

In Python, exposure is mostly indirect: Aikido says urllib3, requests, httpx (with its Brotli extra), aiohttp and Scrapy use Brotli or brotlicffi automatically when installed. Aikido warned on October 23 that advisory databases didn't yet map the CVE to either PyPI package. That has changed: by October 25, the reviewed GitHub advisory and the PyPA advisory database list Brotli (fixed in 1.2.1) and brotlicffi (fixed in 1.2.1.0), so scanners that use them can now flag older versions. For Envoy, the advisory says deployments are affected if they have the Brotli decompressor configured. Istio says its users are affected if they enable Brotli decompression, for example through an EnvoyFilter.

How do I patch or mitigate HTTP2Shell?

Upgrade every component that bundles Brotli, rebuild images and wheels, regenerate lockfiles and restart services. Node.js lists no workaround; Imperva advises checking the Node.js version inside each deployed image.

If you can't upgrade at once, Aikido suggests:

• rejecting inbound requests whose Content-Encoding includes br at a proxy, load balancer or middleware, before any decoder runs;
• removing br from outgoing Accept-Encoding headers and refusing to decode Brotli responses, because a malicious server can send Brotli regardless of what the client asks for;
• in Python, uninstalling Brotli or brotlicffi where they're optional, which may break responses from servers that send Brotli anyway.

Imperva and, according to Aikido, Vercel have added firewall rules, but those don't cover responses your own code fetches.

Is HTTP2Shell being exploited?

There were no confirmed reports by October 26. CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-111497 (catalog version of October 23), and CISA's October 23 assessment, added to the CVE record, rates exploitation as "none." Aikido cites The Hacker News as saying no in-the-wild exploitation had been reported as of October 22. On the same day, Imperva reported that its researchers achieved code execution against the official Node.js 24.22.0 Linux arm64 image through fetch() and through Express 5 or body-parser 2, that it "took multiple attempts in our setup," and that Node.js 24.22.1 rejected the same input. Aikido says the first public proof of concept worked only against a deliberately weakened build.

How did OpenAI find it, and why did the fix take so long to ship?

Node.js credits the report to "OpenAI Codex Security," naming Khai Tran and Sylvie Mayer; the CVE record Google filed names the same team as finder, and Envoy's advisory credits "OpenAI Security Research." None of them says when the report arrived or whether a model found the bug on its own. OpenAI's Patch the Planet initiative, whose disclosure process is examined in our Patch the Planet analysis, has published a Brotli advisory page that, by its own description, covers affected software, fixed releases and how to disable Brotli decoding while patching.

The timing is the odd part. Aikido says the root cause was fixed in Brotli's source in February 2026 but wasn't treated as a security issue, so no release carried the fix until October 21. The upstream commit, "Detect and report invalid stream earlier," changes the decoder's block-switch error handling. Istio shipped Envoy's fix in its October 15 patch releases, six days before public disclosure, which suggests some downstream projects had advance notice.

CVE-2026-111497 from upstream commit to downstream fixes, 2026

1. Feb.Root-cause fix committed to Brotli source, not labeled as securityAikido; GitHubReported
2. Oct. 15Istio 1.31.2, 1.30.6, 1.29.9 ship Envoy's Brotli fixIstioConfirmed
3. Oct. 21Brotli 1.2.1, 1.1.1, 1.0.10 and Node.js security releasesBrotli; Node.jsConfirmed
4. Oct. 22Python Brotli 1.2.1, brotlicffi 1.2.1.0 and Bun 1.4.4PyPI; BunConfirmed
5. Oct. 22Imperva reports lab code execution on Node.js 24.22.0ImpervaReported
6. Oct. 23Envoy advisory; Aikido renames it HTTP2ShellEnvoy; AikidoConfirmed

• Confirmed
• Reported

AI-assisted bug reports are arriving faster than many projects can handle, as our Linux kernel disclosure story shows; Anthropic's OSS Scanner is another lab's attempt to find such bugs first.

What's confirmed, reported and uncertain

• Confirmed (projects): the affected Brotli range, every fixed version in the table, and the OpenAI credits from Node.js and Envoy.
• Confirmed (CVE record): CVSS v4.0 9.2, the impact description and the "OpenAI Codex Security" finder credit; CISA's "none" exploitation rating as of October 23, and no KEV listing as of October 26.
• Reported: Imperva's lab exploitation; the February source fix and "not treated as security" account (Aikido); no in-the-wild exploitation as of October 22 (The Hacker News, via Aikido); Python library exposure paths (Aikido).
• Uncertain: when OpenAI reported the bug, whether a model found it alone, which other products embed vulnerable Brotli builds, and whether exploitation is under way.