Security

HTTP2Shell Checker

Check if your Node.js, Bun, Python Brotli or system Brotli library is patched against HTTP2Shell, also called Node2Shell (CVE-2026-111497), and copy the commands to check, update and block it.

What do you want to check?Version or command output

How to get it

node --version

docker run --rm <image> node --version

npm ls express body-parser

grep -rnE "createBrotliDecompress|brotliDecompress|express\.json|bodyParser" src/

Paste a version

Choose what to check, then paste its version or the output of the command shown below.

Update

nvm install 24 && nvm alias default 24

# Docker: rebuild on a patched base image, e.g. FROM node:24.22.1

Fixed versions (as of 24 October 2026)

Node.js 22.x	22.23.4
Node.js 24.x	24.22.1
Node.js 26.x	26.12.1
Node.js 25, 23, 20, 18	No fix: end of life, upgrade
Bun	1.4.4
Python Brotli (PyPI)	1.2.1
Python brotlicffi (PyPI)	1.2.1.0
Google Brotli (libbrotli)	1.0.10 / 1.1.1 / 1.2.1
Debian 12 bookworm	1.0.9-2+deb12u1
Debian 13 trixie	1.1.0-2+deb13u1
Ubuntu	Needs evaluation: no fixed package yet

Temporary blocks until you can update

These stop Brotli data from reaching a vulnerable decoder. They do not replace the update, and blocking incoming requests does not protect responses your app downloads.

nginx: reject requests whose body is Brotli-compressed (inside the server block)

if ($http_content_encoding ~* "br") {
    return 415;
}

Apache: reject Brotli-compressed request bodies (mod_rewrite)

RewriteEngine On
RewriteCond %{HTTP:Content-Encoding} br [NC]
RewriteRule ^ - [F]

Express 5: stop body-parser from decompressing request bodies (also turns off gzip bodies)

app.use(express.json({ inflate: false }));

Bun: do not auto-decompress a response from a server you don't control

await fetch(url, { decompress: false });

Python: remove the Brotli packages so HTTP clients fall back to gzip

pip uninstall -y Brotli brotlicffi

Checked in your browser. What you paste is never uploaded.

发现问题或有想法？报告问题

HTTP2Shell Checker

您可能还喜欢