Critical Remote Code Execution in Brotli Decoder (CVE‑2026‑111497) Enables HTTP2Shell Attacks Across Multiple Runtimes
What It Is — CVE‑2026‑111497, dubbed HTTP2Shell, is a critical remote‑code‑execution flaw in the Brotli compression library. The vulnerability resides in the decoder’s handling of malformed block‑type switches: the C decoder continues reading past the end of an internal buffer, allowing an attacker to execute arbitrary code without authentication. The bug affects a wide range of runtimes and platforms that embed Brotli, including Node.js, Bun, Envoy, Python, Go‑based Brotli ports (used by Traefik, Fiber, Iris), and others. Researchers demonstrated successful exploitation against Node.js applications shortly after disclosure. The fix landed in Brotli’s source in February 2026 but has not yet been released in many downstream packages, leaving a multi‑month exposure window.
Affected Products — Node.js, Bun, Envoy, Python, Go‑based Brotli implementations (e.g., Traefik, Fiber, Iris) and any application that loads the vulnerable decoder.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of maintaining effective compensating controls for unpatched critical vulnerabilities. Verisq’s Control Mapping capability can capture runtime protection evidence (e.g., virtual‑patch status) to satisfy audit requirements while waiting for vendor patches.
Recommended Actions
- Inventory all services that load the Brotli decoder and verify version exposure.
- Deploy a virtual‑patching solution (e.g., Sweet Virtual Patching) or disable Brotli decompression where feasible until patches are released.
- Enable runtime monitoring to detect exploitation attempts and retain logs as audit evidence.
- Prioritize patching of affected libraries as soon as vendor releases are available.
Source: Help Net Security