Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
- ID
- 39213
- Status
- summarized
- Published
- 24 Oct 2026, 4:06 PM
- Fetched
- 25 Oct 2026, 5:42 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.5
- Created
- 25 Oct 2026, 5:42 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder affecting versions 1.0.3 through 1.2.0 on all platforms (CVSS v4.0 9.2, Critical), where a crafted Brotli stream can leak memory, crash a process, or potentially execute code. Disclosed as "Node2Shell" for Node.js on Wednesday 21 Oct 2026, it widened to Python packages the next day and, by Friday 23 Oct, to other major languages and HTTP-using services; patches now exist for libbrotli, Python, C++, Node.js, bun and Envoy. Aikido notes Apache and Nginx do not decode Brotli by default, and OpenAI says it found the flaw in February and reported it then, though the root-cause fix in Brotli source was not recognised as a security issue at the time.
Why it matters
If any part of your request path decodes Brotli — Node's bundled zlib/brotli, Python packages, a bun service, an Envoy proxy — you have a remote unauthenticated memory-corruption bug reachable by an ordinary compressed request body or response. Check whether you decode Brotli at the app layer (not just at Nginx/Apache, which don't by default), then upgrade to the patched libbrotli/Python/Node/bun/Envoy builds, or disable Brotli decoding entirely until the library you depend on ships a fix.
Discussion angle
Map your own decode chain: how many layers sit between an incoming request and a Brotli decoder in your stack, and would you have known to patch within 48 hours of the Node.js disclosure?