HTTP2Shell: Brotli Vulnerability Explained

A critical flaw in Brotli, a compression library built into thousands of web applications and devices, is being actively exploited. Tracked as CVE-2026-111497 and nicknamed "HTTP2Shell," it can let an unauthenticated attacker crash a system, read its memory, or in some cases, run their own code on it.

Because Brotli is usually built into other software rather than installed on its own, many organizations are exposed without knowing it. This post explains what the vulnerability is, where it tends to hide, which vendors have released fixes, and the steps to take now.

Publish and Update History

Published at 8:30 AM CT on November 2, 2026.

What is HTTP2Shell?

HTTP2Shell is an out-of-bounds write vulnerability in Google's Brotli decoder, the part of Brotli that unpacks compressed data. An attacker sends a specially crafted Brotli-compressed stream, and the decoder writes data outside the memory it should use. The result can be a crash, leaked memory contents, or remote code execution.

Brotli helps web pages and files load faster by shrinking them in transit. It ships inside web servers, browsers, proxies, programming runtimes, and many commercial products. That is why one library flaw reaches so many systems.

The flaw goes by several names, all referring to the same CVE:

Node2Shell: the first name, used when Node.js released its fix on October 21, 2026
Broccoli2Shell: a name used by researchers and several security agencies
HTTP2Shell: the name that reflects its reach across HTTP servers and clients, beyond Node.js

Node.js is not the source of the flaw. It is one of many products that build Brotli in, and has included it since version 10.16.0.

Google rates the flaw 9.2 (Critical) on CVSS 4.0. According to the NIST National Vulnerability Database, Brotli versions 1.0.3 through 1.2.0 are affected. Here's where each one stands:

Your Brotli version	What to do
1.0.3 through 1.0.9	Update to 1.0.10
1.1.0	Update to 1.1.1
1.2.0	Update to 1.2.1

Most organizations won't update Brotli directly. The fix arrives through updates from the vendors whose products include it.

Why it's urgent: attacks are already happening

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026. That listing means CISA has evidence of real-world attacks, not just a theoretical risk. U.S. federal agencies must patch by November 10, 2026.

That deadline applies to federal agencies, but it is a useful benchmark for any organization. Exploitation requires no login, and the attack only needs a vulnerable system to process a malicious compressed stream. Security researchers at Wiz reported that 91% of cloud environments rely on vulnerable components.

Where Brotli shows up in your environment

Most organizations never install Brotli directly. It arrives as a component inside other software. Review anything in these categories:

Node.js-based applications and services
Web servers and web-hosting platforms
Web browsers and browser-based applications
Content delivery networks (CDNs), proxies, and web gateways
Firewalls and network security appliances
Cloud applications and web services
Business software that runs on Node.js or similar frameworks, including print management and production software
Other software or infrastructure that processes compressed web traffic

If a vendor's product runs on Node.js, .NET, Python, or a web server, ask the vendor whether it bundles an affected version of Brotli.

Vendor fixes released so far

Several vendors whose products are common in business environments have released fixes or guidance:

Microsoft .NET: out-of-band security updates for supported .NET versions (advisory)
Palo Alto Networks PAN-OS: fixes for affected PAN-OS versions (advisory)
Cisco: fixes for some affected products, with others still under investigation (advisory)
PHP: updated official Windows builds (advisory)
Node.js: patched releases across supported versions (advisory)
Konica Minolta AccurioPro Flux: a cumulative security patch (see below)

This list is current as of publication and is not complete. More vendors are still assessing their products, and Marco will update this post as new fixes are released. Always check your vendor's advisory for the exact version that applies to you.

AccurioPro Flux users: a security patch is available

Konica Minolta has released a cumulative security patch for AccurioPro Flux. It addresses recently disclosed Node.js vulnerabilities, including CVE-2026-111497, in the software that Flux Server and Flux Web run on. Flux versions 10.0 through 10.4.2 are affected; earlier versions are not.

Konica Minolta reports no known attacks on AccurioPro Flux using these vulnerabilities. Because the vulnerability is already being exploited in other software, Konica Minolta released the patch ahead of the next AccurioPro Flux service release. It urgently recommends updating now instead of waiting for that release.

Available to all clients: the patch installer works with Flux versions 8.0 through 10.4.2 and doesn't require a Software Maintenance Plan (SMP).
Install it everywhere Flux runs: apply the patch on every machine running Flux Server, Flux Web, or Flux Workstation. If Flux Workstation is installed later, run the patch again.

As a Konica Minolta partner, Marco can help you apply it. Contact your Marco representative to get started.

What to do now

Inventory your exposure. Identify systems, applications, and vendor products that use Brotli, including third-party software and dependencies. Start with internet-facing systems.
Apply vendor updates. Install the fixed versions from each vendor as soon as they are available.
Restart and redeploy. After patching, restart affected processes and rebuild any container images that include Brotli. A patch on disk does not protect a process that is still running the old code.
Reduce risk where you can't patch yet. Stop affected applications from processing Brotli-compressed content from untrusted sources, or block it at the proxy or firewall.
Watch for warning signs. Monitor for unexpected crashes, unusual process behavior, or other suspicious activity on affected systems.
Ask your vendors. For any product that runs on Node.js, .NET, Python, or a web server, ask whether it bundles an affected Brotli version and when a fix is coming.

Frequently asked questions about the HTTP2Shell vulnerability

Here are answers to the questions we're hearing most from business leaders this week.

What is CVE-2026-111497?

CVE-2026-111497, also called HTTP2Shell, Node2Shell, or Broccoli2Shell, is a critical out-of-bounds write vulnerability in Google's Brotli decompression library. A crafted compressed stream can crash a system, leak memory, or allow remote code execution.

Is HTTP2Shell a Node.js vulnerability?

No. The flaw is in Brotli. Node.js is affected because it includes Brotli as built-in functionality, as do many other products.

Is HTTP2Shell being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a federal patching deadline of November 10, 2026.

Which Brotli versions fix the vulnerability?

Brotli 1.0.10, 1.1.1, and 1.2.1. Most organizations will get the fix through updates from the vendors whose products include Brotli.

Does it affect AccurioPro Flux?

Yes, versions 10.0 through 10.4.2. Konica Minolta has released a security patch for AccurioPro Flux that addresses CVE-2026-111497 in its underlying Node.js software. Konica Minolta reports no known attacks on AccurioPro Flux.

For Marco's Managed IT clients

If you're a Marco Managed IT client, our Endpoint Detection and Response (EDR) and Managed Detection and Response (MDR) solutions add a layer of protection by detecting suspicious activity linked to attempted exploitation. These controls reduce risk, but they don't replace remediation. Vendor-recommended updates remain the priority.

Marco will keep monitoring this vulnerability and update this post as new information and vendor guidance become available. If you need help finding where Brotli lives in your environment or applying updates, our team is ready to help.