HTTP2Shell Vulnerability in Brotli Prompts Urgent Security Updates

Researchers have discovered a critical security vulnerability dubbed HTTP2Shell in the Brotli compression library, which could allow attackers to corrupt memory and access sensitive data, according to BleepingComputer.

The vulnerability is tracked as CVE-2026-111497, and is also known as Broccoli2Shell and Node2Shell, affecting Brotli versions 1.0.3 through 1.0.9, as well as versions 1.1.0 and 1.2.0.

The vulnerability affects the C decoder library embedded in Node.js, and Python clients such as urllib3[brotli], requests, httpx, and aiohttp[speedups] may also be affected when using an affected version of Brotli.

Microsoft released an out-of-band security update to address the issue in .NET on Sunday, warning that exploiting the vulnerability could allow privilege escalation on systems using an affected version.

What Do These Terms Mean?

CVE: A common identifier assigned to each known security vulnerability to facilitate tracking and sharing information about it among researchers and companies.

Brotli: An open-source data compression library that compresses files before sending them so they arrive faster without altering their content.

Memory Corruption: A flaw that allows writing data outside the allocated space, potentially opening the door to executing commands or reading sensitive information.

Privilege Escalation: An attacker obtaining a higher level of access than permitted on the system.