TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Brotli decoder vulnerability CVE-2026-111497, first disclosed in Node.js as Node2Shell, has been reported in other languages and HTTP-related software. As of Oct. 23, 2026, patches are available for several major projects, but operators still need to check bundled dependencies and confirm vendor fixes.
The Brotli decoder flaw CVE-2026-111497, first disclosed in Node.js as Node2Shell, has been found in other language packages and HTTP-related software, broadening the set of systems that may need security updates. Aikido Security reported the wider impact on October 23, 2026, and said fixes were then available for projects including Node.js, Python packages, Bun and Envoy, while other vendor coverage remained in progress.
The vulnerability is described as an out-of-bounds write in Google’s Brotli decoder, affecting upstream versions 1.0.3 through 1.2.0 across platforms. According to Aikido’s report, a remote attacker could provide crafted compressed data to a vulnerable decoder, potentially corrupting memory and causing a crash, exposing data or enabling code execution. The report lists a CVSS v4.0 score of 9.2; that rating describes the assessed severity, not evidence that systems have been exploited.
The flaw is not limited to Node.js because other projects use or bundle Brotli. Aikido said Python packages, C++ software and HTTP-related services were among the affected areas it was tracking. It reported available fixes for libbrotli, Python, C++, Node.js, Bun and Envoy, with more patches expected. The specific status differs by product and release branch: listed fixes include Node.js 22.23.4, 24.22.1 and 26.12.1; Bun 1.4.4; and Envoy 1.40.0, 1.39.3, 1.38.6 and 1.37.8.
Aikido’s report also names patched releases for Istio and upstream Brotli, and advises updating operating-system packages through the relevant vendor. Python users are told to update Brotli to 1.2.1 or later and brotlicffi to 1.2.1.0 or later where installed. Applications with statically linked or bundled copies may require a new application build, not just a system package update. Aikido cautioned that, as of Oct. 23, some advisory databases did not map the CVE to the affected PyPI packages, so common dependency scanners might not flag them.
Why Bundled Brotli Widens Exposure
The broader impact matters because Brotli is used to compress web content, and HTTP clients and services may rely on it indirectly through libraries or bundled components. Teams that check only whether their main application is written in Node.js could miss a vulnerable decoder inside a Python client, proxy, service mesh or other dependency. The exposure depends on whether software actually decodes attacker-controlled Brotli data and on the version in use; the report does not establish that every product named is vulnerable in every configuration.
Aikido describes potential risk in both directions: a malicious client could send crafted compressed input to a server, while a malicious server could return it to a client that accepts compressed responses. That possibility makes the issue relevant to service operators as well as organizations running HTTP clients. The report says Apache and Nginx do not decode Brotli by default in the configurations it discusses, which is a reminder that product name alone does not determine exposure. Administrators need to check enabled features, dependency versions and vendor advisories.
Where no fixed release is available, Aikido recommends disabling Brotli decoding if feasible until a patch can be applied. For patched systems, teams should update dependency locks, rebuild affected containers or compiled applications, redeploy and verify that running workloads use the fixed component. A package update that does not replace a statically bundled copy may leave the vulnerable code in service.
As an affiliate, we earn on qualifying purchases.
From Node.js Disclosure to Wider Fixes
Node.js disclosed the issue as CVE-2026-111497 on Wednesday, Oct. 21, according to Aikido. The report says the issue became known in Python packages the following day, then was reported to affect other major languages and HTTP-facing applications on Friday, Oct. 23. That progression shifted attention from one runtime to the shared compression component used by a wider software ecosystem.
Aikido attributes the vulnerability to an error in Brotli’s decoder that allowed it to continue accepting bytes when it should reject malformed data. The report says OpenAI found the issue in February and that the underlying source-code problem was fixed then, but was not recognized as a security issue at the time. Aikido says no release containing the fix shipped until the current security response, leaving projects that bundled Brotli to issue their own updates.
The report identifies upstream fixed Brotli releases as 1.2.1, 1.1.1 and 1.0.10, depending on the release line. It also notes that operating-system vendors may backport security fixes without changing the upstream version number, so a version string alone may not show whether a package is patched. Affected organizations should consult the advisory for their exact product and supplier.
““If there is no patch available for a library or application that may be affected, we recommend disabling Brotli decoding until patches become available.””
— Aikido Security
network security monitoring appliance IDS IPS
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Which Deployed Copies Are Still Vulnerable
The list of affected software and fixed releases was still developing in Aikido’s Oct. 23 update. The report says additional patches were expected, but does not provide a complete inventory of every HTTP library, application, operating-system package or managed service that uses Brotli. It is also not clear from the supplied material whether the vulnerability has been exploited in real-world attacks.
Organizations may have Brotli through transitive dependencies, compiled binaries or container images, and the report does not identify which individual deployments are exposed. Nor does a version number necessarily settle the question: vendors can backport fixes, while bundled copies may not be updated by installing a system package. Aikido also says some Python package advisory databases did not yet associate the CVE with the relevant PyPI packages, limiting the reliability of automated alerts at that point.
secure software development lifecycle handbook
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch, Rebuild and Verify Services
Operators should check whether their applications and dependencies decode Brotli data, identify the actual library version or vendor package, and apply the security-fixed release for the relevant supported branch. For Node.js, Python packages, Bun, Envoy, Istio and native Brotli, Aikido lists specific fixed versions in its Oct. 23 guidance; teams should confirm those details against current vendor advisories before deployment.
Where immediate patching is not possible, Aikido recommends disabling Brotli decoding when the feature is optional and feasible to turn off. After updating, teams should refresh dependency locks, rebuild images and binaries that bundle the decoder, redeploy and restart affected services, then verify the running workloads rather than relying only on a source-code or package-manager change. The next development is expected to be further vendor advisories and fixes for products not covered by the available patch list.
Linux server administration and patch management book
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is Node2Shell or HTTP2Shell?
Node2Shell is the name used for CVE-2026-111497 when it was disclosed in Node.js. Aikido used HTTP2Shell to describe the wider concern after reporting the same Brotli decoder flaw in other language packages and HTTP-related software. The supplied report does not identify HTTP2Shell as a separate CVE.
What can an attacker do with the Brotli flaw?
Aikido says crafted Brotli data sent to a vulnerable decoder could corrupt memory and potentially cause a crash, expose sensitive data or enable arbitrary code execution. These are reported possible impacts; the supplied material does not confirm exploitation in active attacks.
Which versions are fixed?
Aikido lists upstream Brotli fixes in 1.2.1, 1.1.1 and 1.0.10, with product-specific fixes including Node.js 22.23.4, 24.22.1 and 26.12.1, Bun 1.4.4, and several supported Envoy releases. Check the relevant vendor advisory because package versions and backports vary.
Could vulnerability scanners miss this issue?
According to Aikido, as of Oct. 23 some advisory databases did not map the CVE to the affected Python packages, so tools such as pip-audit, Dependabot and Safety might not flag vulnerable versions. A manual review of dependencies and vendor notices may be needed.
What should teams do if no patch is available?
Aikido recommends disabling Brotli decoding where possible until a patch is released. Once a fix is available, update the affected component, rebuild software or images that bundle it, redeploy and confirm the running service uses the patched code.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
