A critical bug in Google’s Brotli compression library, tracked as CVE-2026-111497 and nicknamed HTTP2Shell, now has fixes across the stacks most custom web apps run on. Google tagged Brotli 1.2.1 on October 21, the same day Node.js shipped its October security releases. Patched Python packages followed on October 23, and Microsoft pushed emergency .NET updates on October 25, BleepingComputer reported on Monday. The HTTP2Shell Brotli vulnerability matters most for businesses running Node.js, Python or .NET apps, which covers a lot of client portals, custom CRMs and API connectors.

What’s new

The Node.js project said in its advisory that malformed compressed input can write past the end of an internal decoder buffer. An attacker who can get an app to decompress crafted Brotli data can crash it, read process memory or run code. The GitHub Advisory Database rates the flaw critical, at 9.2 on CVSS v4.

  • Brotli: versions 1.0.3 through 1.2.0 are affected. Fixed in 1.0.10, 1.1.1 and 1.2.1.
  • Node.js: fixed in 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and other end-of-life lines get no fix.
  • Python: brotli 1.2.1 and brotlicffi 1.2.1.0. Libraries like urllib3, requests, httpx and aiohttp use Brotli automatically when it’s installed.
  • .NET: 8.0.33, 9.0.22 and 10.0.14, according to Microsoft’s advisory as reported by BleepingComputer. Brotli decompression in .NET is opt-in, so only apps that turned it on are exposed.

BleepingComputer said proof-of-concept code is public, with no confirmed attacks in the wild so far. Cloudflare added two emergency WAF rules on October 25, one for requests that send Brotli-compressed bodies and one for the Next.js image resizing endpoint (/_next/image). Both default to Log, so they block nothing until you switch them to Block.

Who it affects

Owners of custom web apps, booking systems, client portals and API middleware built on Node.js, Next.js, Python or .NET. Background scripts that pull data from outside services count too, because a malicious response can trigger the bug as easily as a malicious request.

A standard WordPress site on PHP is in a better spot. PHP isn’t on the affected lists published so far, and security firm Upwind notes that Apache and nginx don’t decode Brotli request bodies by default. For a WordPress-only site this is mostly your host’s job. PHP had its own serious flaw this month, covered in our PHP2Shell checklist.

Our take

We’d treat this as a this-week patch for any Node.js, Python or .NET app you own. Ask your developer or host to update the runtime and the Brotli packages in each project, then rebuild and redeploy containers, since updating the system library doesn’t fix apps that bundle their own copy. If an app still sits on Node.js 20 or older, plan the upgrade now. If you’re behind Cloudflare, watch the two new rules in Log mode for a day before blocking, because the Next.js rule can stop resized images from loading.

Not sure what your apps run on? Our Next.js development and API and connector teams can check your stack as part of a free audit.