HTTP2Shell: AI-found Brotli flaw spreads to many apps

1. What happened

A vulnerability (CVE-2026-111497) was found in the decoder of Brotli, Google's compression library, the part that restores compressed data. It can corrupt memory and may allow code to be run remotely. Versions 1.0.3 through 1.2.0 are affected, and the CVSS 4.0 base score is 9.2 (Critical), according to a report by Mado no Mori carried on Yahoo News Japan (report). The Brotli project published v1.2.1, v1.1.1 and v1.0.10 with the fix on October 21, 2026 (official Brotli release).

AI was involved in the discovery. On October 23, OpenAI said it found the Brotli flaw during an internal red-teaming exercise. It explains that no account is needed to exploit it: an unpatched server could be taken over by a malicious client, and an unpatched client (it cites "curl --compressed") by a malicious server. The root-cause code had been fixed in February, but nobody knew it was a security hole at the time and no new release followed (OpenAI's post on X).

2. The impact is widening

According to the security firm Aikido Security, Node.js shipped an update on October 21; every supported release line had the flaw, and Bun had it up to v1.4.4. It was first called "Node2Shell", but by October 23 it had become clear that other languages and apps that handle HTTP, such as Python packages, are affected too, and the name "HTTP2Shell" is now in use. Some products still lack fixes, and Aikido advises disabling Brotli decoding in libraries or apps without a patch. It also writes that Apache and Nginx do not decode Brotli by default (Aikido: Node2Shell, Aikido: HTTP2Shell).

3. Why it matters to small businesses

Brotli is used to compress HTTP traffic so that websites and online shops load faster. Even if your company writes no code itself, it may sit inside parts built by your web agency or outside services, such as booking systems, payment and inventory links, or webhook receivers. Companies that do not know which component uses what will take longer to check.

Our view What matters here is less the hole itself than the speed at which an old defect found by AI chains through libraries, languages and apps within days. This is the second such case within a week of PHP2Shell, and a company with no one in charge of updates stays exposed to takeover for every day it puts the check off. We think the time it takes to respond next time depends on whether you keep a list of what your sites and systems run on and agree an update route with your web agency.

4. What small businesses should check now

Ask your web agency or maintenance company whether they have dealt with Brotli CVE-2026-111497, and have them list your sites and linked systems that use Node.js, Bun, Python and similar
For systems on Node.js, have the version checked against the fixed releases issued on or after October 21, 2026
If you have a business system built in Python, have them check whether the Brotli package from PyPI is a fixed version (a GitHub advisory has been published)
For components with no fix yet, discuss whether Brotli decoding can be switched off temporarily, along with the side effects of doing so
Have features that call outside URLs (webhooks, external integrations) checked first, because a reply from a malicious server can be the way in

Our outlook

We expect the speed at which AI finds flaws in old code to keep rising. After PHP2Shell, this case suggests a pattern in which developers such as OpenAI hunt for holes with AI and downstream products follow with updates. Over the next 6 to 24 months, we think customers and business partners will increasingly ask about a company's software update arrangements as a condition of trading. Having an update owner, a contact route and a list of the components in use in place now is, in our judgment, what makes now the time to lay the groundwork. Small firms that can answer a partner's security questionnaire in a day, because they already know which systems run which components, will keep their place in procurement comparisons, while those that need weeks to find out risk being dropped from the shortlist before price is even discussed. We would treat any company still without an update owner by the end of this year as behind its peers.

Questions this article answers

What is the Brotli vulnerability (HTTP2Shell), and does it affect my company?

It is a flaw (CVE-2026-111497) in the decoder of Google's Brotli compression library, rated 9.2 in severity. Node.js, Bun and Python packages are among those affected, and fixed versions have been appearing since October 21. Ask your web agency whether any of your systems use Node.js or Python.

Does HTTP2Shell affect WordPress or shared-hosting sites?

What this article could confirm from source pages are Node.js, Bun, Python packages and Envoy. Aikido writes that Apache and Nginx do not decode Brotli by default. We could not confirm any effect on WordPress itself, so check the announcements from your service provider.

Sources

Related Q&A

Related services

If you want to try this in your own business

To see how the topics in this article would apply to your own operations, and what it would cost, send us a message through the contact form.