A Brotli bug found in February shipped no fix until now, and it reaches far beyond Node.js
Node.js disclosed 'Node2Shell', a critical Brotli decoder flaw. Researchers then found it in Python HTTP clients, Bun, Envoy, Istio and curl.
CVE-2026-111497 (CVSS 9.2) lets a crafted Brotli stream trigger an out-of-bounds write, and it works in both directions: a malicious server can hit a client, and a malicious client can hit a server.
The thread argued about the name. Whether HTTP is really exposed turned out to depend on one setting.
A decoder that cannot tell 'malformed' from 'need more input'
According to Aikido's write-up, the flaw sits in Google's Brotli decompression library, versions 1.0.3 through 1.2.0. The function DecodeBlockTypeAndLength() returns a boolean that cannot separate a malformed stream from one that needs more input, and the fast path ignores the return value entirely. A crafted stream can exhaust a block's length and force an impossible block switch, after which the decoder keeps going with stale state and writes out of bounds. That can leak data, crash the process or execute code.
OpenAI reports it found the bug in February. The fix landed in the Brotli source then, but no release shipped it until now.
Who is affected
- Node.js through its bundled Brotli (fixed in 22.23.4, 24.22.1, 26.12.1)
- Python clients that load Brotli automatically when installed: urllib3/requests, httpx, aiohttp, Scrapy (Brotli 1.2.1)
- Bun 1.4.4, Envoy and Istio patch lines, curl/libcurl and other products that bundle it
- Apache and Nginx are reportedly unaffected by default because they do not decode Brotli by default
Scanners such as pip-audit and Dependabot may not flag it yet. Rebuild container images after upgrading. If you cannot patch, uninstall Brotli, reject Content-Encoding: br and stop advertising br; changing Accept-Encoding alone is not enough.
The thread: 'you might as well call it Exploit Pro Max'
Most of the discussion was about the branding.
"It's so meaningless, broad and undescriptive of the actual issue. No it probably doesn't affect an HTTP server with nothing else behind it, so why is HTTP being blasted?" — netsharc
A correction arrived in one line.
"Actually it does, if the server is willing to decompress POST bodies." — cowlevel
TZubiri, a backend developer with 10+ years in C and Python offered the cynical logic: HTTP2Shell appeals to everyone who uses HTTP, while Brotli2Shell would not wake up the people who need to patch. Another suggested the more honest handle.
"Just call it CVE-2026-111497. More accurate and much easier to remember and to talk about with your boss." — rererereferred
If your service accepts compressed request bodies, check for Brotli in your dependency tree and in base images before you assume your edge proxy shields you.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Google's Finnish data-center site was cleared without an environmental assessment, and Finland is angry
Reports say about 250,000 trees were felled for a Google data center in Finland without the correct permits. The commenters who followed Finnish news said the story is bigger than the headline makes it.