OpenAI's Codex Security reported the Brotli flaw
Two people from OpenAI Codex Security found a bug in Google's Brotli library and reported it to the Node.js project. Brotli is a compression format and library from Google that shrinks the data sent over HTTP, so pages and API responses travel faster.
Many products embed Brotli. Node.js, the runtime that runs JavaScript on servers, is one of them, and so are Bun and the Python Brotli package. OpenAI published a page on its Patch the Planet site that lists fixed versions and a stopgap.
Crafted compressed data can lead to code execution
The bug sits in the decoder, the part of Brotli that turns compressed data back into the original. When an app decodes Brotli data that an attacker has crafted, memory gets corrupted. The result can be a crash, a leak of memory contents, or code running on the attacker's behalf.
According to Node.js, the decoder treated a malformed block switch as a sign that more input was on the way, when it should have stopped with an error. It kept adding bytes to an internal buffer only eight bytes long and wrote past its end.
Node.js rates the bug high. The CVE number, the shared public ID for a known vulnerability, is CVE-2026-111497.
"A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer." ／ "An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution." — Brotli decoder out-of-bounds write entryView official source →
Khai Tran and Sylvie Mayer reported the bug
The Node.js advisory credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting the flaw. On the Node.js side, mcollina and aduh95 wrote the fix, which shipped on October 21.
Codex Security and Patch the Planet are both part of OpenAI's effort to find and fix vulnerabilities (related: OpenAI Daybreak: GPT-5.5-Cyber and Codex Security). The Patch the Planet page for this bug was last updated on October 23.
"Thank you, to OpenAI Codex Security - Khai Tran and Sylvie Mayer for reporting this vulnerability and thank you mcollina and aduh95 for fixing it." — Brotli decoder out-of-bounds write entryView official source →
Why the bug is called HTTP2Shell
The flaw first went by Node2Shell because Node.js disclosed it, and it is now also called HTTP2Shell. The newer name took hold once it was clear the root cause sits in Brotli's C code and reaches many products that use Brotli for HTTP.
Both names point to the same bug. Despite the name, HTTP/2 itself has no flaw here. Searching by CVE-2026-111497 is the reliable way to find the right advisories.
"本脆弱性はNode.jsが2026年10月21日に公表した脆弱性に関連して「Node2Shell」と呼称されていました。しかし、本脆弱性の原因はBrotliのC言語実装にあり、BrotliはHTTP通信で利用されるデータ圧縮ライブラリであったことから複数の製品で影響を受けるため「HTTP2Shell」とも呼称されています。" — 「I. 概要」View official source →
Google, Node.js, Bun and others shipped fixes
Google, which maintains Brotli, and the projects that bundle it have all released fixed versions. Updating to one of them is the main fix.
Google fixed all three Brotli release lines
Google released Brotli 1.2.1, 1.1.1 and 1.0.10 on October 21, one fix for each release line. Affected versions:
- 1.2.0 up to, but not including, 1.2.1
- 1.1.0 up to, but not including, 1.1.1
- 1.0.3 up to, but not including, 1.0.10
Japan's national CERT, JPCERT/CC, urges teams to test and then apply the fixed versions without delay. Products that embed Brotli ship fixes on their own schedules, so check each vendor's advisory too.
"Brotli v1.2.0からv1.2.1より前のバージョン" ／ "Brotli v1.1.0からv1.1.1より前のバージョン" ／ "Brotli v1.0.3からv1.0.10より前のバージョン" ／ "十分なテストを実施の上、速やかに修正済みバージョンを適用してください。" — 「II. 対象」「III. 対策」View official source →
Fixed Brotli versions by project
Besides Node.js and Bun, the Envoy Proxy and Istio traffic proxies also have fixed releases. Patch the Planet listed these versions as of October 23.
Fixed Brotli versions by project (Patch the Planet, October 23)
| Project | Fixed versions | Notes |
|---|---|---|
| Node.js | 22.23.4 / 24.22.1 / 26.12.1 | The 22.x, 24.x and 26.x lines are affected |
| Bun | 1.4.4 | Includes Brotli 1.2.1 |
| Envoy Proxy | 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8 | 1.36.12 has the fix, but 1.36 is unsupported |
| Istio | 1.29.9 / 1.30.6 / 1.31.2 | 1.29 is end of life |
| Brotli (Google) | 1.0.10 / 1.1.1 / 1.2.1 | Pick the fix for your release line |
A later patched release in the same line works too. After updating, restart or redeploy every service, worker, scheduled job and replica that runs the old build. Until then, the old Brotli code is still running.
"Fixed releases · Reviewed October 23, 2026" ／ "Update to a listed fixed version or a later patched release in the same branch, then restart or redeploy." ／ "Restart or redeploy every service, worker, scheduled job, and replica using the old build." — Start patching sectionView official source →
Who is exposed to the Brotli decoder bug
Any app that feeds attacker-controlled Brotli data into an unpatched decoder is exposed. OpenAI names three common ways that data gets in:
- Compressed HTTP request bodies
- Responses fetched from servers you don't trust
- Compressed files
Web services and background workers are on the list, along with tools that bundle Node.js or Bun. Electron desktop apps can carry more than one copy of Brotli, so a patched browser engine inside the app does not mean its bundled Node.js is patched.
curl and libcurl, Python and Java bindings, and font or data-file readers that use Brotli also need checking. The exposure goes beyond HTTP traffic.
"Any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed. This includes compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files." ／ "a fixed browser component does not establish that the embedded Node.js runtime is fixed." ／ "Exposure is not limited to HTTP traffic." — Who is affected sectionView official source →
Compressing outgoing data alone does not expose you
A server that only uses Brotli to compress what it sends is not exposed by that alone. The bug lives on the decoding side, not the compressing side.
That changes if the same server also decodes Brotli data it receives. Switching off Brotli response compression on a CDN or web server does not stop request or client-side decoding, OpenAI notes.
"Using Brotli only to compress outgoing data does not by itself establish exposure to this decoder flaw." ／ "Turning off Brotli response compression on a CDN or web server does not disable request or client-side decompression." — Who is affected and Mitigation sectionsView official source →
Can't patch yet? Stop decoding untrusted Brotli data
If you can't patch right away, OpenAI says to turn off Brotli decoding of untrusted data until the update is in. Gzip, deflate and other formats can stay on.
For incoming requests, reject bodies marked as Brotli before any proxy or parser decodes them. In Envoy Proxy and Istio, switch off the Brotli decompressor for both requests and responses. Dropping br from the Accept-Encoding header is not enough, because a server can still send Brotli.
Google has not published a workaround for Brotli itself beyond updating. For products that embed Brotli, follow each vendor's latest guidance.
"If you cannot patch immediately, disable Brotli decompression of untrusted data until the update is deployed." ／ "Disable Brotli decoding of untrusted data while allowing gzip, deflate, or other supported codecs." ／ "Removing br from Accept-Encoding alone does not stop a server from sending it." — Overview and Mitigation sectionView official source →
What companies and employees should do about HTTP2Shell
Because Brotli is built into so much software, the only way to know whether you're affected is to check what you run, one product at a time. JPCERT/CC asks anyone using an affected product to apply fixes promptly based on the vendor's guidance. It also asks them to check whether they have already been compromised.
"本脆弱性の影響を受ける製品を利用している場合は、開発者が提供する情報などを参考に、速やかに対策の適用および侵害有無の調査を実施してください。" — 「I. 概要」View official source →
Companies should find each Brotli decoding path and patch it
The first job for a company is an inventory of everywhere Brotli data gets decoded. Look across in-house web services, internal tools and third-party products for two things:
- Anything running Node.js or Bun
- Envoy Proxy or Istio setups configured to decompress Brotli
Test and update what you find, then restart it. Where an update has to wait, block Brotli-encoded input in the meantime. Alongside the update, look for signs the flaw was already used against you.
"アプリケーションなどでBrotli形式の圧縮データを展開する処理を利用している場合は、各開発元が提供する最新の情報を確認し、影響の有無および本脆弱性への対応状況を確認してください。" — 「II. 対象」View official source →
Employees should keep work apps and tools up to date
The step every employee can take is to keep the desktop apps and tools they use for work up to date. Electron apps often bundle Node.js, and a fixed browser engine inside the app does not mean its Node.js is fixed. When an app offers an update, install it instead of putting it off.
Employees who write code should also check the Node.js and Bun versions on their own machines. If they are older than the fixed versions in the table above, update them.
"apps such as Electron-based desktop tools can include multiple Brotli copies. Check both Chromium and Node.js" — Other software to check sectionView official source →
FAQ
- Are HTTP2Shell and Node2Shell different bugs?
- No. Both names refer to the same Brotli flaw, CVE-2026-111497. It was first called Node2Shell because of the Node.js disclosure. Once it became clear the root cause sits in Brotli itself and affects many products, it also became known as HTTP2Shell.
- Is a server that only compresses responses with Brotli exposed?
- Not by that alone. The bug is in the decoder, the side that restores compressed data. The same server is exposed, though, if it also decodes Brotli data it receives from outside.
- What should I do if I can't patch right away?
- Turn off Brotli decoding of untrusted data until the update is in place. You can keep gzip, deflate and other formats switched on.
Related articles
AI crawler training opt-out in one robots.txt ruleAI crawler training opt-out now takes one robots.txt rule. OpenAI, Google and Microsoft will honor it, Microsoft from Feb. 1, 2027. Until then, name each bot.
Nintendo Switch 2 jailbreak uses a bug Codex foundSammy Hajhamid released ns2jb, a software-only Switch 2 jailbreak. OpenAI's Codex found the SmileBASIC bug it starts from; he spent two weeks on the rest.
OpenAI's GPT-6 arrives on Google Cloud in previewGPT-6 Astra, Sol and Luna are in Google Cloud's Model Garden for select enterprises, billed via Google Cloud. Prompts aren't used for training. No price yet.
AGENTS.md in Downloads hijacks AI coding agentsAn AGENTS.md in a Downloads folder told Codex to install malware. In Forever Security's tests, Codex obeyed over 90% of the time and Claude Code about half.