A critical vulnerability in Google’s Brotli compression library has set off a wave of patching across a large part of the software world. Tracked as CVE-2026-111497 and dubbed Node2Shell (also called HTTP2Shell or Broccoli2Shell), the flaw has led to security updates for Node.js, Microsoft .NET, Visual Studio, PowerShell and popular Python packages.
What makes it stand out is that it is not a bug in one product but in an invisible building block. Brotli is embedded in countless pieces of software, from browsers and servers to runtimes and archive tools, to compress web traffic. So the real question is not “do we use Brotli?” but “where are we using Brotli without knowing it?”
What is the vulnerability and how does it work?
Node2Shell is an out-of-bounds write in Brotli’s decoder. Specially crafted compressed input can push data beyond the limits of a buffer used by the decoder. Memory corruption bugs of this kind can, under the right conditions, be turned into remote code execution (RCE).
- Affected Brotli versions: 1.0.3 through 1.2.0
- Severity: CVSS v4 9.2 (critical) according to Google; CVSS v3.1 8.1 (elevation of privilege) according to Microsoft
- Discovery: the OpenAI Codex Security team, during red-teaming
One telling detail: according to OpenAI, the root cause had been fixed in the Brotli source code in February, before anyone realised it was a security issue. Because no release containing the fix shipped, downstream projects stayed vulnerable. It is a good illustration of how wide the gap between “fixed upstream” and “fixed for users” can be in the open-source supply chain.
Who is affected and which versions are safe?
- Brotli library: 1.0.10, 1.1.1, 1.2.1
- Node.js: 22.23.4, 24.22.1, 26.12.1 (October 2026 security releases)
- .NET runtime: 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3
- Visual Studio: 2019, 2022 and 2026 updates
- PowerShell: 7.4, 7.5, 7.6 updates
- Python (PyPI): Brotli 1.2.1, brotlicffi 1.2.1.0
Bun, Envoy and Istio have shipped updates as well. A community-maintained tracker listed projects such as DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as not yet patched, and its maintainers note that the list is incomplete. There is no fix for Node.js 20, which is end-of-life and should be upgraded.
Microsoft rates the flaw critical for .NET and Visual Studio and important for PowerShell, with an exploitability assessment of “Exploitation More Likely”.
Exploitation status: how real is the risk?
At the time of reporting, no confirmed in-the-wild exploitation had been published. The picture is still not reassuring:
- Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, through a request body processed by Express 5 or body-parser 2, or through a server response. The exploit has not been released and did not succeed on every attempt.
- A proof of concept on GitHub achieves code execution only against an intentionally weakened build, and some researchers argue the real-world impact is limited to denial of service.
These details matter, but they are not enough to base a decision on. Reliable exploits for memory corruption bugs take time to develop, yet in an era when frontier AI models speed up both vulnerability discovery and exploit development, that window is shrinking fast. With PHP2Shell, the move from “no exploitation yet” to working attacks took only days.
Why so widespread? The invisible dependency problem
Brotli is involved everywhere from Content-Encoding: br compression in HTTP responses to processing compressed files and archives. All an attacker needs is to get compressed data they control into a Brotli decoder. As OpenAI put it in its “Patch the Planet” advisory, any application that passes attacker-controlled data to an affected Brotli decoder may be exposed. Typical scenarios:
- Web applications and APIs that decompress compressed HTTP request bodies
- Clients, browser automation and integrations that process responses from untrusted servers
- Workflows that open compressed files supplied by users
The library rarely arrives directly; it usually comes in through a runtime or a third-party package. In container images and off-the-shelf software, teams may not even know it is there.
A 6-step action plan for organisations
1. Find the hidden copies of Brotli
Scan your software bill of materials (SBOM) and dependency trees for Brotli, brotlicffi and embedded copies. Put internet-facing applications at the top of the list. Attack surface management solutions such as Cortex Xpanse also reveal externally reachable assets the organisation does not know about.
2. Update runtimes and packages
Upgrade Node.js, .NET, PowerShell, Visual Studio and Python packages to the patched versions above. Use the opportunity to move end-of-life versions (such as Node.js 20) to a current LTS release.
3. Restart services
Updating the package is not enough: running processes keep using the old, vulnerable code until they are restarted. Restart every affected service after updating.
4. Rebuild container images
Containers carry the libraries they were built with. Rebuild images on a patched base image and redeploy, and scan the older images in your registry. Code-to-cloud security platforms such as Cortex Cloud help catch images with vulnerable packages before they reach production.
5. Review where untrusted compressed data is processed
Check whether APIs that accept compressed request bodies actually need to. If not, disable it at the reverse proxy or application layer, and enforce request size limits.
6. Add network-layer protection while you patch
Patching every system at once is not realistic for most organisations. In the meantime, inline prevention layers such as Palo Alto Networks Advanced Threat Prevention can act as a virtual patch against exploitation attempts. Check the coverage of the relevant signatures and make sure your profiles are set to block.
Albisec’s take
Node2Shell shows once again how deep the dependency chains of modern software run. A single bug in one compression library can affect runtimes, developer tools, service-mesh components and data platforms at the same time. The lasting answer is not a one-off patching scramble: risk becomes manageable when an up-to-date software inventory, automated image rebuilds and network-layer protection that covers the patching window work together.
At Albisec we can help you inventory your internet-facing applications, review your Palo Alto Networks Advanced Threat Prevention profiles and prioritise patching. Get in touch or open a support ticket.
Sources: SecurityWeek, “Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages”, Eduard Kovacs, 26 October 2026; Node.js October 2026 security releases. Image: Albisec.
