CVE-2026-111497 · Broccoli2Shell / HTTP2Shell / Node2Shell · Brotli decoder out-of-bounds write

Broccoli2Shell - HTTP2SHELLFixed vs not fixed, by product family

Q: What is Broccoli2Shell (HTTP2Shell, CVE-2026-111497)?

Broccoli2Shell, also called HTTP2Shell or Node2Shell, is CVE-2026-111497: an out-of-bounds write in the Google Brotli decoder (c/dec/decode.c) affecting Brotli 1.0.3 to 1.2.0. Any software that decodes attacker-controlled Brotli data, such as HTTP request or response bodies with Content-Encoding: br, can be exposed.

Q: Which Brotli versions are vulnerable and which are fixed?

Google Brotli 1.0.3 through 1.2.0 are vulnerable. Fixed releases are 1.0.10, 1.1.1 and 1.2.1, published on 21 October 2026. Versions 1.0.2 and earlier are below the affected range.

Q: Which Node.js versions fix HTTP2Shell?

Node.js 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026, fix CVE-2026-111497. Node.js 20, 23 and 25 are end of life and will not receive a fix.

Q: Are Bun, Python and .NET affected?

Yes. Bun 1.0.21 to 1.4.3 is affected and fixed in 1.4.4. Python Brotli is fixed in 1.2.1 and brotlicffi in 1.2.1.0; several wheels that vendor their own decoder (Pillow, pyarrow, curl-cffi, pycurl) remained unfixed on 26 October 2026. .NET is fixed in 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected. Deno is not affected.

Q: What can I do if I cannot upgrade yet?

Reject inbound requests whose Content-Encoding includes br (case-insensitive, including inside lists) at the proxy or load balancer. For outbound traffic, remove br from Accept-Encoding and reject br responses before decoding. Cloudflare's managed WAF rules ship in Log mode and must be overridden to Block; Azure WAF DRS 2.2 rule 920450 blocks in Prevention mode.

Q: How many products are fixed as of 27 October 2026?

Of 83 tracked products, 42 are fixed, 12 have a fix in progress, 17 are vulnerable with no fix, 5 have no vendor statement, 3 are not affected and 4 have WAF mitigations live.

Q: How severe is CVE-2026-111497?

Google, as the CNA, scores it CVSS 4.0 9.2 Critical. Microsoft scores the .NET path CVSS 3.1 8.1 with high attack complexity (AC:H), because exposure needs an opt-in configuration. It rates it Critical for .NET and Visual Studio and Important for PowerShell. Red Hat rates it Important, Node.js rates it High and Ubuntu rates it Medium.

Q: Is there a working public exploit?

The first public proof of concept (22 October) reached code execution only on a deliberately weakened test build; on a standard build it crashed the process and leaked limited memory. Imperva separately reported unreliable code execution on the official Node.js 24.22.0 Linux arm64 image. Microsoft lists the flaw as publicly disclosed, not exploited, with exploitation "more likely". Treat crash-level denial of service as the realistic floor.

Status of each product, day by day. Updated 27 October 2026 (see the corrections log). Vendor statements and public trackers only.

Summary: Broccoli2Shell (HTTP2Shell, Node2Shell, CVE-2026-111497) is an out-of-bounds write in the Google Brotli decoder, c/dec/decode.c, in Brotli 1.0.3–1.2.0. Fixed upstream in Brotli 1.0.10, 1.1.1 and 1.2.1 and in Node.js 22.23.4, 24.22.1 and 26.12.1 on 21 October 2026. As of 27 October 2026, 42 of 83 tracked products are fixed and 17 remain vulnerable with no fix, mostly through bundled Brotli copies. Severity ratings differ: CVSS 4.0 9.2 Critical (Google as CNA), CVSS 3.1 8.1 for .NET (Microsoft) and Important (Red Hat).

Read the Phoenix Security blog: HTTP2Shell / Node2Shell analysis →HTTP2Shell expansion: bundled Brotli copies →

Hover or tap a row for affected and fixed versions, notes and sources. Days after today show the current status carried forward, not a forecast.

How to patch HTTP2Shell CVE-2026-111497

Update the affected runtime or Brotli library:

Node.js: upgrade to 22.23.4, 24.22.1, or 26.12.1, or any newer supported release on that line.
Native Brotli / libbrotli: 1.2.1 or later. Older branches: patched 1.0.10 or 1.1.1.
Python: Brotli ≥ 1.2.1 and brotlicffi ≥ 1.2.1.0, wherever installed. Also audit wheels that vendor their own decoder (Pillow, pyarrow, curl-cffi, pycurl).
curl / libcurl: move the Brotli dependency to 1.2.1, a patched older release, or the vendor's fixed package. Bundled or statically linked copies need a new application build.
Bun: 1.4.4 or later. Rebuild compiled executables that bundle Bun.
.NET: runtime 8.0.33, 9.0.22 or 10.0.14 (11.0.0-rc.3 for .NET 11), or SDK 8.0.427 / 8.0.133, 9.0.320 / 9.0.123, 10.0.403 / 10.0.114 (out-of-band, 25 Oct). Rebuild NativeAOT and self-contained apps. Brotli decoding is off by default in .NET, so only apps that opt in are exposed.
Visual Studio and PowerShell: Visual Studio 2026 18.11.2, 2022 17.14.43, 2019 16.11.61; PowerShell 7.6.9, 7.5.13, 7.4.22.
Envoy: 1.40.0, 1.39.3, 1.38.6, or 1.37.8, or newer on a supported branch. 1.36.12 also has the fix, but 1.36 is unsupported.
Istio: fixed in 1.29.9, 1.30.6 and 1.31.2. Use a newer supported release; 1.29 is end of life.
Operating-system packages: install the vendor's security update. Backports often keep the old upstream version number.
Other servers, proxies, gateways and clients: update the runtime or Brotli library they use. If Brotli is bundled, install the vendor release that explicitly addresses this CVE. For managed services, confirm remediation with the provider.

Update lockfiles, then rebuild applications and container images, redeploy, and restart services. Finally, check that running workloads actually load the patched components.

What to do if you can't upgrade yet

Incoming HTTP requests: reject any request whose Content-Encoding includes br at the reverse proxy, load balancer or middleware, before a vulnerable decoder sees the body. Match br case-insensitively, including inside lists of encodings: (?i)(^|,)\s*br\s*(,|$).
Outbound HTTP requests: remove br from Accept-Encoding. Also disable Brotli response decoding, or reject responses whose Content-Encoding includes br before decoding starts. Do this check before any automatic body processing; checking after the client has downloaded and decoded the response is too late. Node's fetch() decodes br even when you request identity.
WAF rules are inbound only. Cloudflare's two managed rules ship in Log mode, so override them to Block. Azure DRS 2.2 rule 920450 blocks in Prevention mode.

Fixed releases, updated 27 October 2026

Project	Fixed versions	Notes
Google Brotli	1.0.10 · 1.1.1 · 1.2.1	Pick the fixed release for your branch.
Node.js	22.23.4 · 24.22.1 · 26.12.1	20 / 23 / 25 are EOL with no fix.
Bun	1.4.4	Includes Brotli 1.2.1.
PyPI Brotli / brotlicffi	1.2.1 · 1.2.1.0	PYSEC-2026-4322 / 4323.
.NET runtime	8.0.33 · 9.0.22 · 10.0.14 · 11.0.0-rc.3	SDK 8.0.427 · 9.0.320 · 10.0.403 (or 8.0.133 · 9.0.123 · 10.0.114). .NET Framework not affected.
Visual Studio · PowerShell	18.11.2 · 17.14.43 · 16.11.61 · 7.6.9 · 7.5.13 · 7.4.22	Patched 25 Oct with .NET.
Ubuntu brotli	1.0.9-2ubuntu0.1 · 1.1.0-2ubuntu0.1 · 1.2.0-3ubuntu0.1 · 1.2.0-4ubuntu0.1	USN-8956-1 for 22.04 – 26.10.
Go · MuPDF · UEFITool	v1.2.7 · 1.28.0 · A76	andybalholm/brotli, MuPDF, UEFITool.
Envoy	1.40.0 · 1.39.3 · 1.38.6 · 1.37.8	1.36.12 also fixed, but unsupported.
Istio	1.29.9 · 1.30.6 · 1.31.2	1.29 is EOL.
Ruby · PHP · Perl · Java	0.9.1 · 0.21.1 · 0.023 · 1.24.0	brotli gem, PHP ext, IO::Compress::Brotli, brotli4j.

Severity and exploitation

Scores differ because vendors rate different exposure paths. Use the one that matches the component you run.

Source	Rating	Vector / basis
Google (CNA), shown by GitHub, OSV and NVD	CVSS 4.0 9.2 Critical	AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H — OSV
Microsoft (.NET)	CVSS 3.1 8.1; Critical for .NET and Visual Studio, Important for PowerShell	AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — GHSA-p3jp-9v83-76w9, SecurityWeek
Red Hat	Important	Red Hat CVE page
Node.js	High	Node.js security release
Ubuntu	Medium	Ubuntu CVE tracker

Public PoC: the first proof of concept (22 Oct) reached code execution only on a deliberately weakened test build; on standard builds it crashes the process with a limited memory read (The Hacker News).
Stock build: Imperva reported code execution on the official Node.js 24.22.0 Linux arm64 image via fetch() and Express 5 body-parser, but not on every attempt; other architectures and lines were not tested (HeroDevs).
In the wild: Microsoft lists it as publicly disclosed, not exploited, with exploitation "more likely" (SecurityWeek).

Corrections log

Changes made to the tracker and the Phoenix Security article since the first draft.

Patch status that flipped as vendors shipped

The first draft listed the Ruby gem (0.9.1), PHP extension (0.21.1), MuPDF (1.28.0) and UEFITool (A76) as unpatched. All four had shipped fixes.
.NET was listed as unpatched until Microsoft's out-of-band release on 25 Oct.

.NET build numbers

The article listed only 8.0.33 / 9.0.22 / 10.0.14. Microsoft's advisory gives these as the patched runtime and runtime-pack versions. The matching SDK builds are 8.0.427 / 9.0.320 / 10.0.403 (or 8.0.133 / 9.0.123 / 10.0.114 on the older feature bands), plus 11.0.0-rc.3 for .NET 11 (dotnet/announcements #494). Both are now shown, labelled.
Added: Brotli decoding is off by default in .NET, so exposure needs an opt-in (ASP.NET Core request decompression, HttpClient AutomaticDecompression, or BrotliStream/BrotliDecoder).
Added: Microsoft scores the .NET path 8.1 (AC:H), below the CNA's 9.2.
Added: Visual Studio 2019 / 2022 / 2026 and PowerShell 7.4 / 7.5 / 7.6 fixes.

Severity and exploitation

Only the 9.2 Critical score was shown; Red Hat's Important and Microsoft's 8.1 are now included.
The public PoC was presented as a working exploit. It reaches RCE only on a deliberately weakened build; standard builds crash.

Version and ecosystem errors

Ubuntu 22.04 – 26.10 were marked "needs evaluation"; they are fixed by USN-8956-1 (24.04: libbrotli1 1.1.0-2ubuntu0.1). 16.04 – 20.04 still need evaluation.
Bun's affected range is 1.0.21 – 1.4.3.
Added fixed bindings: brotli4j 1.24.0, Perl IO::Compress::Brotli 0.023 (its own CVE-2026-115936), Go andybalholm/brotli v1.2.7, plus Debian DSA-6582-1 and Docker node image timing.

Verify list

Dropping the Aikido reference left the February fix date and the EPSS figure unsourced. The 27 Feb date now points to the upstream commit; the EPSS figure is not shown until it is re-sourced.
Microsoft's Azure Linux patch is reported but not yet confirmed against a Microsoft source, so it isn't in the table.

Broccoli2Shell / HTTP2Shell status table, 27 October 2026

Text version of the timeline above: every tracked product with affected versions, fixed versions and current status.

Product	Affected	Fixed in	Status today	Notes
Upstream Brotli (C library)
Brotli 1.2.x	1.2.0	1.2.1	Fixed (21 Oct)	Tagged 21 Oct, about 19:27 UTC. The fix is commit 0ed4268 from 27 Feb, which nobody had recognised as a security fix.
Brotli 1.1.x	1.1.0	1.1.1	Fixed (21 Oct)	Backport branch release.
Brotli 1.0.x	1.0.3 – 1.0.9	1.0.10	Fixed (21 Oct)	The vulnerable early return first appears in 1.0.3.
Brotli ≤ 1.0.2	—	n/a	Not affected	Below the CVE's affected range (1.0.3 is the lower bound).
JavaScript runtimes
Node.js 26.x	< 26.12.1	26.12.1	Fixed (21 Oct)	Published 21 Oct, 10:38 UTC. process.versions.brotli still reports 1.2.0 (cherry-picked fix), so check the Node version instead.
Node.js 24.x LTS	< 24.22.1	24.22.1	Fixed (21 Oct)	Imperva demonstrated RCE on 24.22.0 linux/arm64.
Node.js 22.x LTS	< 22.23.4	22.23.4	Fixed (21 Oct)
Node.js 20 / 23 / 25 (EOL)	all	none	Vulnerable, no fix	End-of-life lines get no fix. Move to 22, 24 or 26.
Docker official node images	tags before fixed builds	22.23.4 · 24.22.1 · 26.12.1	Fixed (21 Oct)	Slim tags were pushed 21 Oct and full/Alpine tags 22 Oct. Cached base layers stay vulnerable until you pull fresh and rebuild.
Bun	1.0.21 – 1.4.3	1.4.4	Fixed (22 Oct)	Released 22 Oct, 10:11 UTC, with Brotli 1.2.1. Rebuild any bun build --compile executables.
Electron 42+ (Chromium 148+)	—	carried via Chromium 148	Fixed	Tanium says Electron builds Node against Chromium's Brotli. Electron has made no statement, and its release index still lists Node 24.22.0 / 24.19.0.
Electron ≤ 41 apps	≤ 41.x	app vendor update	Vulnerable, no fix	Needs a vendor rebuild on a supported Electron version. Check desktop apps such as Slack, Discord and Signal.
GraalJS (graal-nodejs)	≤ 25.4.4.1.1	master (unreleased)	Fix in progress	Merged to master 22 Oct. GraalVM ships quarterly, so there is no release yet.
Deno	—	n/a	Not affected	Uses the Rust brotli-decompressor, not the C decoder.
Python packages
PyPI Brotli	1.0.3 – 1.2.0	1.2.1	Fixed (22 Oct)	PYSEC-2026-4322; published 22 Oct, 13:57 UTC. Just having it installed makes requests/urllib3, httpx and aiohttp decode br.
PyPI brotlicffi	< 1.2.1.0	1.2.1.0	Fixed (22 Oct)	PYSEC-2026-4323; published 22 Oct, 16:19 UTC.
Wheels with vendored decoders	latest releases	none yet	Vulnerable, no fix	19 popular packages, including Pillow, pyarrow, curl-cffi, pycurl, tensorflow and jaxlib. pip show Brotli won't reveal these copies, and PyPI/OSV don't list them.
brotlipy (abandoned)	all	none	Vulnerable, no fix	When installed, it can shadow a fixed Brotli at import time. Uninstall it.
Other language runtimes & bindings
.NET 8 / 9 / 10 (+ 11 RC)	runtime < 8.0.33 · < 9.0.22 · < 10.0.14	runtime 8.0.33 · 9.0.22 · 10.0.14 · 11.0.0-rc.3 — SDK 8.0.133/8.0.427 · 9.0.123/9.0.320 · 10.0.114/10.0.403	Fixed (25 Oct)	Out-of-band release 25 Oct. Off by default: ASP.NET Core request decompression and HttpClient automatic decompression are not enabled unless you opt in, or call BrotliStream/BrotliDecoder directly. Microsoft scores it CVSS 3.1 8.1 (AC:H). NativeAOT and self-contained apps must be rebuilt. .NET Framework is not affected.
Visual Studio 2019 / 2022 / 2026	< 16.11.61 · < 17.14.43 · < 18.11.2	16.11.61 · 17.14.43 · 18.11.2	Fixed (25 Oct)	Patched alongside .NET on 25 Oct. Microsoft rates it Critical for Visual Studio.
PowerShell 7.4 / 7.5 / 7.6	< 7.4.22 · < 7.5.13 · < 7.6.9	7.4.22 · 7.5.13 · 7.6.9	Fixed (25 Oct)	Patched 25 Oct. Microsoft rates it Important for PowerShell.
Java brotli4j (Netty)	< 1.24.0	1.24.0	Fixed (24 Oct)	1.24.0 bundles Brotli 1.2.1.
Ruby brotli gem	< 0.9.1	0.9.1	Fixed (24 Oct)	On RubyGems 24 Oct, 05:31 UTC. Refuses an unpatched system libbrotli.
PHP brotli extension	< 0.21.1	0.21.1	Fixed (24 Oct)	Bundles Brotli 1.2.1. Reached via brotli_uncompress().
Perl IO::Compress::Brotli	0.004001 – < 0.023	0.023	Fixed (23 Oct)	Tracked as CVE-2026-115936. The bundled copy means a system libbrotli update does not fix it.
Go andybalholm/brotli	< v1.2.7	v1.2.7	Fixed (24 Oct)	Separate implementation of the same logic flaw, likely crash-only. Release date not stated; listed as fixed by 24 Oct. Used by Traefik and Caddy plugins.
Proxies, service mesh & web servers
Envoy 1.37 – 1.40	1.39.2 · 1.38.5 · 1.37.7	1.40.0 · 1.39.3 · 1.38.6 · 1.37.8	Fixed (06 Oct)	Fixed releases shipped quietly on 6 Oct; the advisory followed 23 Oct. Only affected when the Brotli decompressor filter is configured.
Envoy 1.36 (unsupported)	1.36.11	1.36.12	Fixed (06 Oct)	Has the fix, but the branch is unsupported. Move to a supported branch.
Istio 1.30 / 1.31	1.31.0–1.31.1 · 1.30.0–1.30.5	1.30.6 · 1.31.2	Fixed (15 Oct)	Only affected when Brotli decompression is enabled (for example via EnvoyFilter).
Istio 1.29 (EOL)	1.29.0 – 1.29.8	1.29.9 (final)	Fixed (15 Oct)	1.29 reached end of life 15 Oct. Move to a supported line.
ngx_brotli module	builds on Brotli < 1.2.1	submodule → 1.2.1 (no tag)	Fixed (22 Oct)	Submodule updated 22 Oct with no release tag; rebuild the module. Mostly compresses, so the decoder is rarely reached.
nginx official Docker images	libbrotli1 1.1.0-2+b7	rebuild pending	Vulnerable, no fix	nginx itself doesn't decode Brotli, but images used as application bases inherit the library.
Apache mod_brotli / nginx core	—	n/a	Not affected	Neither decodes Brotli by default.
HTTP clients, dev tools & apps
curl for Windows (static)	< 8.23.0_4	8.23.0_4	Fixed (24 Oct)	Release date not stated; listed as fixed by 24 Oct. Distro libcurl follows the system libbrotli.
Git for Windows	2.56.0.windows.3 (Brotli 1.2.0)	none yet	Vulnerable, no fix	Released 22 Oct still listing brotli 1.2.0-1.
VS Code Server	< 1.143.1	1.143.1	Fixed (24 Oct)	Bundles Node 24.22.1. Date not stated; listed as fixed by 24 Oct.
Kibana 9.5 / 9.4 / 8.19	9.5.5 · 9.4.8 · 8.19.23 (Node 24.21.0)	next patch (Node 24.22.1)	Fix in progress	Branches were bumped 21 Oct, but no fixed artifact has been published. Issue #299985 is open.
UEFITool	< A76	A76	Fixed (24 Oct)	Bundles Brotli 1.2.1.
EDK II firmware	bundled 1.2.0	issue #13378	Vulnerable, no fix	Decodes compressed firmware sections. Cherry-pick 0ed4268.
MuPDF	1.27.x and earlier	1.28.0	Fixed	Fixed: 1.28.x picked up the upstream fix in April. Upgrade from 1.27.x, which is not being patched.
7-Zip-zstd · p7zip	bundled 1.2.0 · 1.0.9	none yet	Vulnerable, no fix	Reached when a user opens a .br file or archive. 7-Zip-zstd tracks it as issue #579.
NanaZip	≤ 7.0.1873.0	main 3da1c6a (unreleased)	Fix in progress	Fixed on main; release pending. Date shows when it was first observed.
libjxl	≤ v0.12.0	main PR #5062 (unreleased)	Fix in progress	Fixed on main; release pending.
woff2 (Makefile build) · v8-jsi	bundled 1.0.3 · 1.2.0	none yet	Vulnerable, no fix	The woff2 CMake build links the system library instead (issue #207).
Databases & data engines
DuckDB	vendored 1.1.0	PR #27791 (open)	Fix in progress	Reached by decoding Brotli-compressed Parquet. Fix PR opened 25 Oct.
ClickHouse	own fork	PR #127419 (open)	Fix in progress	Reached through HTTP bodies, files and Parquet.
YDB	bundled	main 343f6be (unreleased)	Fix in progress	Fixed on main 23 Oct; release pending.
Apache Arrow / pyarrow	bundled 1.0.9	issue #55166	Vulnerable, no fix	Brotli-compressed Parquet. Only an issue is open; there is no fix yet.
Browsers
Chrome / Edge / WebView2 148+	< 148	148.0.7778.96+	Fixed	Chrome has carried the fix since 5 May. Edge and WebView2 are inferred from Chromium.
Firefox 150 · ESR 140.10 · ESR 115.35	< 150 (non-ESR)	150 · 140.10 · 115.35	Fixed	Fixed before disclosure (MFSA 2026-30). Thunderbird is inferred.
RHEL Firefox / Thunderbird pkgs	RHEL 8 / 9 / 10	none listed	Vulnerable, no fix	Red Hat lists these as affected. Amazon Linux lists its Firefox as not affected.
Linux distributions & package managers
Debian 12 / 13	1.0.9-2 · 1.1.0-2	1.0.9-2+deb12u1 · 1.1.0-2+deb13u1	Fixed (24 Oct)	DSA-6582-1. Debian's nodejs uses the system Brotli, so the brotli update fixes Node too. Restart processes afterwards.
Debian sid	1.2.0-4	1.2.0-4.1	Fixed (24 Oct)
Debian forky (testing)	1.2.0-4	none yet	Vulnerable, no fix	Waiting to migrate from sid.
Alpine 3.21 – 3.24, edge	brotli < fixed	1.1.1-r0 · 1.2.1-r0	Fixed (24 Oct)	1.1.1-r0 for 3.21/3.22 and 1.2.1-r0 for 3.23/3.24/edge. nodejs-current 26.12.1-r0.
Ubuntu 22.04 – 26.10 brotli	1.0.9-2 · 1.1.0-2 · 1.2.0-3 · 1.2.0-4	1.0.9-2ubuntu0.1 · 1.1.0-2ubuntu0.1 · 1.2.0-3ubuntu0.1 · 1.2.0-4ubuntu0.1	Fixed (26 Oct)	USN-8956-1, 26 Oct. 24.04 LTS is fixed in libbrotli1 1.1.0-2ubuntu0.1. Ubuntu priority: Medium.
Ubuntu 16.04 – 20.04 brotli	1.0.x	none listed	No vendor statement	Still "Needs evaluation" on Ubuntu's tracker as of 27 Oct.
Ubuntu 20.04 nodejs	vendored Brotli	none listed	Vulnerable, no fix	On 22.04 and later, nodejs uses the system Brotli.
RHEL 8 / 9 / 10	brotli · nodejs	no erratum	Vulnerable, no fix	Rated Important. RHEL 8 nodejs:24 bundles Brotli 1.2.0 in libnode.so, which is under re-evaluation in Bugzilla.
Red Hat Hardened Images	—	RHSA-2026:87420	Fixed (24 Oct)	Red Hat's only fixed product so far.
OpenShift 4 / Satellite 6	bundled Brotli	no erratum	Vulnerable, no fix	Listed as affected, with no errata.
Fedora Rawhide / ELN	brotli < 1.2.1	1.2.1	Fixed (24 Oct)
Fedora 45	brotli < 1.2.1	brotli-1.2.1-1.fc45	Fix in progress	FEDORA-2026-6a639d1308 is in updates-testing.
Fedora 43 / 44	brotli < 1.2.1	none yet	Vulnerable, no fix
openSUSE Tumbleweed	brotli · nodejs24	1.2.1-1.1 · 24.22.1-1.1	Fixed (24 Oct)	openSUSE-Tumbleweed-2026-12232 / 12248.
SLES 15 SP6 / SP7 nodejs22	< 22.23.4	22.23.4-150700.3.21.1	Fix in progress	SUSE lists it as in QA. Its other Node and brotli packages are still under analysis.
Amazon Linux 2023 brotli · nodejs24	—	ALAS2023-2026-3334 · -3330	Fixed (24 Oct)
Amazon Linux 2023 nodejs / nodejs20	all	No Fix Planned	Vulnerable, no fix	Move to the nodejs24 package.
Amazon Linux 2027 Preview	brotli · nodejs24	Pending Fix	Fix in progress
Homebrew brotli + node	brotli < 1.2.1	1.2.1 · node 26.12.1 · @24 · @22	Fixed (22 Oct)	Bottles published 22 Oct. Node formulas link the shared brotli formula.
Cloud & hosting platforms
Azure App Service (Linux)	built-in Node	22.23.4 · 24.22.1	Fixed (22 Oct)	Rollout complete on both release channels 22 Oct.
Azure Functions (Linux)	built-in Node	patched runtime	Fixed (24 Oct)	Rollout reported complete 24 Oct.
Azure App Service / Functions (Windows)	built-in Node	22.23.4 · 24.22.1	Fix in progress	Rollout started 22 Oct and is not complete. A Windows Consumption host still ran Node 24.19.0 on 23 Oct.
Heroku	older buildpacks	26.12.1 · 24.22.1 · 22.23.4	Fixed (21 Oct)	Available 21 Oct; you must redeploy to pick it up.
Vercel managed runtimes	22.x / 24.x / 20.x	patched runtime rollout	Fix in progress	Rollout in progress. Node 20 projects must move to 22/24.
AWS Lambda managed runtimes	nodejs22.x / 24.x	depends on update mode	No vendor statement	No AWS bulletin found. Auto mode updates on its own; Function update and Manual modes, and container images, need action.
Google Cloud Run / Functions	nodejs22 / 24	—	No vendor statement	No issue-specific notice found.
Netlify · Render	—	—	No vendor statement	No issue-specific notice found. Render defaults new services to a pre-fix 24.x unless you pin a version.
Cloudflare Workers (workerd)	node:zlib Brotli	—	No vendor statement	Cloudflare has published WAF rules but no runtime statement.
Edge mitigations (inbound only)
Vercel WAF	—	managed rules	WAF mitigation live	Deployed 21 Oct. Does not cover responses your code fetches.
Imperva WAF	—	rule	WAF mitigation live	Rule announced alongside Imperva's 22 Oct research post.
Azure WAF (App GW / Front Door)	—	DRS 2.2 rule 920450 + custom rule	WAF mitigation live	Rule 920450 blocks in Prevention mode. A custom regex rule covers older rulesets and Front Door Standard.
Cloudflare Managed Ruleset	—	…ca706f3c · …402fe5bb	WAF mitigation live	Both rules ship in Log mode by default. Override to Block.

Broccoli2Shell (CVE-2026-111497) FAQ

What is Broccoli2Shell (HTTP2Shell, CVE-2026-111497)?

Broccoli2Shell, also called HTTP2Shell or Node2Shell, is CVE-2026-111497: an out-of-bounds write in the Google Brotli decoder (c/dec/decode.c) affecting Brotli 1.0.3 to 1.2.0. Any software that decodes attacker-controlled Brotli data, such as HTTP request or response bodies with Content-Encoding: br, can be exposed.

Which Brotli versions are vulnerable and which are fixed?

Google Brotli 1.0.3 through 1.2.0 are vulnerable. Fixed releases are 1.0.10, 1.1.1 and 1.2.1, published on 21 October 2026. Versions 1.0.2 and earlier are below the affected range.

Which Node.js versions fix HTTP2Shell?

Node.js 22.23.4, 24.22.1 and 26.12.1, released on 21 October 2026, fix CVE-2026-111497. Node.js 20, 23 and 25 are end of life and will not receive a fix.

Are Bun, Python and .NET affected?

Yes. Bun 1.0.21 to 1.4.3 is affected and fixed in 1.4.4. Python Brotli is fixed in 1.2.1 and brotlicffi in 1.2.1.0; several wheels that vendor their own decoder (Pillow, pyarrow, curl-cffi, pycurl) remained unfixed on 26 October 2026. .NET is fixed in 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected. Deno is not affected.

What can I do if I cannot upgrade yet?

Reject inbound requests whose Content-Encoding includes br (case-insensitive, including inside lists) at the proxy or load balancer. For outbound traffic, remove br from Accept-Encoding and reject br responses before decoding. Cloudflare's managed WAF rules ship in Log mode and must be overridden to Block; Azure WAF DRS 2.2 rule 920450 blocks in Prevention mode.

How many products are fixed as of 27 October 2026?

Of 83 tracked products, 42 are fixed, 12 have a fix in progress, 17 are vulnerable with no fix, 5 have no vendor statement, 3 are not affected and 4 have WAF mitigations live.

How severe is CVE-2026-111497?

Google, as the CNA, scores it CVSS 4.0 9.2 Critical. Microsoft scores the .NET path CVSS 3.1 8.1 with high attack complexity (AC:H), because exposure needs an opt-in configuration. It rates it Critical for .NET and Visual Studio and Important for PowerShell. Red Hat rates it Important, Node.js rates it High and Ubuntu rates it Medium.

Is there a working public exploit?

The first public proof of concept (22 October) reached code execution only on a deliberately weakened test build; on a standard build it crashed the process and leaked limited memory. Imperva separately reported unreliable code execution on the official Node.js 24.22.0 Linux arm64 image. Microsoft lists the flaw as publicly disclosed, not exploited, with exploitation "more likely". Treat crash-level denial of service as the realistic floor.

Sources

Status reflects what each vendor or tracker published by 27 Oct 2026. "Fixed by" dates mark when a source first listed the fix if the vendor gave no release date. "In progress" covers merged-but-unreleased fixes, packages in QA or testing, and rollouts that are still running.

How to patch HTTP2Shell CVE-2026-111497

What to do if you can't upgrade yet

Fixed releases, updated 27 October 2026

Severity and exploitation

Corrections log

Patch status that flipped as vendors shipped

.NET build numbers

Severity and exploitation

Version and ecosystem errors

Verify list

Broccoli2Shell / HTTP2Shell status table, 27 October 2026

Broccoli2Shell (CVE-2026-111497) FAQ

What is Broccoli2Shell (HTTP2Shell, CVE-2026-111497)?

Which Brotli versions are vulnerable and which are fixed?

Which Node.js versions fix HTTP2Shell?

Are Bun, Python and .NET affected?

What can I do if I cannot upgrade yet?

How many products are fixed as of 27 October 2026?

How severe is CVE-2026-111497?

Is there a working public exploit?

Share-ready excerpts

Sources