Security

HTTP2Shell Checker

Check if your Node.js, Bun, Python Brotli or system Brotli library is patched against HTTP2Shell, also called Node2Shell (CVE-2026-111497), and copy the commands to check, update and block it.

How to get it
node --version
docker run --rm <image> node --version
npm ls express body-parser
grep -rnE "createBrotliDecompress|brotliDecompress|express\.json|bodyParser" src/
Paste a version

Choose what to check, then paste its version or the output of the command shown below.

Update
nvm install 24 && nvm alias default 24
# Docker: rebuild on a patched base image, e.g. FROM node:24.22.1
Fixed versions (as of 24 October 2026)
Node.js 22.x22.23.4
Node.js 24.x24.22.1
Node.js 26.x26.12.1
Node.js 25, 23, 20, 18No fix: end of life, upgrade
Bun1.4.4
Python Brotli (PyPI)1.2.1
Python brotlicffi (PyPI)1.2.1.0
Google Brotli (libbrotli)1.0.10 / 1.1.1 / 1.2.1
Debian 12 bookworm1.0.9-2+deb12u1
Debian 13 trixie1.1.0-2+deb13u1
UbuntuNeeds evaluation: no fixed package yet
Temporary blocks until you can update

These stop Brotli data from reaching a vulnerable decoder. They do not replace the update, and blocking incoming requests does not protect responses your app downloads.

nginx: reject requests whose body is Brotli-compressed (inside the server block)
if ($http_content_encoding ~* "br") { return 415; }
Apache: reject Brotli-compressed request bodies (mod_rewrite)
RewriteEngine On RewriteCond %{HTTP:Content-Encoding} br [NC] RewriteRule ^ - [F]
Express 5: stop body-parser from decompressing request bodies (also turns off gzip bodies)
app.use(express.json({ inflate: false }));
Bun: do not auto-decompress a response from a server you don't control
await fetch(url, { decompress: false });
Python: remove the Brotli packages so HTTP clients fall back to gzip
pip uninstall -y Brotli brotlicffi

Checked in your browser. What you paste is never uploaded.

Compressed data blocks flowing into a server, with a shield stopping one cracked block and a patch on the rack

How to use

  1. Choose what to check: Node.js, Bun, the Python Brotli or brotlicffi package, the Brotli library itself, or a Debian/Ubuntu brotli package.
  2. Run the command shown under How to get it on the server, in the container image or in CI, and paste the output (or just the version).
  3. Read the verdict and the fixed version. Copy the update command, then restart the service and rebuild images.
  4. If you can't update today, copy a temporary block from the bottom of the tool.

What HTTP2Shell is

HTTP2Shell is a nickname for CVE-2026-111497, the same bug first called Node2Shell. It is an out-of-bounds write in Google's Brotli decoder, versions 1.0.3 to 1.2.0. A malformed block switch was treated as "need more input" instead of a format error, so the streaming decoder kept writing into an eight-byte internal buffer. Google rates it 9.2 (critical) on CVSS 4.0; Node.js rates it high.

Any program that decompresses attacker-supplied Brotli data with an affected decoder can be hit: a crash, leaked memory, or possibly code execution. The name changed because the bug is not limited to Node.js; Python packages, Bun and other software that bundle Brotli are affected too. There is no separate "HTTP2Shell" flaw, and despite the name it is a bug in the Brotli decoder, not in the HTTP/2 protocol.

Are you exposed?

Two paths of compressed data reaching a Brotli decoder: a request sent to a server and a response downloaded from an unknown server

Brotli is decoded in two places. Inbound: your server decompresses a request body sent with Content-Encoding: br. Express 5 does this through body-parser 2.x, which decodes br by default. Express 4 (body-parser 1.x) does not. Outbound: your app downloads a response from a server you don't control, and the HTTP client decodes Content-Encoding: br automatically. Node.js fetch(), Bun fetch(), and Python requests, urllib3, httpx and aiohttp (when a Brotli package is installed) all do this.

Apache's mod_brotli and nginx only compress responses; they do not decode request bodies by default.

Fixed versions

A server with an update arrow and a container image being rebuilt with a wrench

Fixes published from 21 October 2026:

SoftwareFixed in
Node.js 22 / 24 / 2622.23.4 / 24.22.1 / 26.12.1
Node.js 20, 23, 25 and olderNo fix (end of life)
Bun1.4.4
Python Brotli / brotlicffi1.2.1 / 1.2.1.0
Google Brotli library1.0.10, 1.1.1, 1.2.1
Debian 12 / 131.0.9-2+deb12u1 / 1.1.0-2+deb13u1

How to check and fix

A terminal window, a container and a server, with a magnifying glass checking a version tag

Run node --version inside the real runtime: each container image, CI runner and serverless function, not only the host. A tag such as node:24 does not tell you the patch number, so rebuild on a patched base image. For Python, run pip show Brotli brotlicffi in every environment and image; pipdeptree -r -p Brotli shows what pulled it in.

Debian's Node.js uses the system Brotli library, so update the brotli package as well. Ubuntu listed the CVE as "needs evaluation" with no fixed package yet. Red Hat-family and Alpine builds keep their own numbers; check the vendor's advisory. Bun binaries built with bun build --compile embed the runtime and stay vulnerable until rebuilt.

If you can't update yet

A gateway shield stopping a cracked compressed data block while ordinary messages pass through

Reject requests whose Content-Encoding contains br at the reverse proxy or load balancer, or turn off request decompression in your framework (express.json({ inflate: false })). For outbound requests, removing br from Accept-Encoding is not enough, because a malicious server can send Brotli anyway; disable decompression for untrusted URLs (Bun: fetch(url, { decompress: false })) or, in Python, uninstall Brotli and brotlicffi. Run Node.js as an unprivileged user and keep secrets out of its environment. These steps reduce risk; they do not replace the update.

Frequently asked questions

Is HTTP2Shell being exploited?

As of 23 October 2026 it was not in CISA's Known Exploited Vulnerabilities catalog and no attacks in the wild had been confirmed. Researchers have publicly reported crashes and code execution in lab conditions, so treat it as urgent.

Is HTTP2Shell the same as Node2Shell?

Yes. Both names refer to CVE-2026-111497. HTTP2Shell came into use on 23 October as the bug turned out to affect more than Node.js.

Is it related to PHP2Shell?

No. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a separate flaw in PHP, disclosed the same week. Check PHP with the PHP2Shell Checker.

My site runs on nginx or Apache. Am I affected?

Not through the web server itself in its default setup. You can still be affected through an application behind it, such as a Node.js or Python app, or through a module that decodes Brotli request bodies.

Is what I paste uploaded?

No. The version check runs in your browser, and nothing you paste leaves your device.

Share

You might also like