HTTP2Shell Vulnerability Exposes Node.js and Python Runtimes to Remote Code Execution

Security researchers at Aikido Security have sounded alarms over an escalating remote code execution vulnerability dubbed http2shell, warning that the flaw reaches far beyond its initial disclosure. The threat stems from an underlying out-of-bounds write buffer overflow in Google Brotli decompression, tracked under CVE-2026-111497, that can permit unauthenticated remote code execution against affected endpoints. Software engineers and security teams worldwide are now evaluating whether their network-facing services are exposed.

The vulnerability originally drew attention within the ecosystem under the moniker Node2Shell, centered on risks facing Node.js environments processing compressed web traffic. However, as security analysts evaluated the wider software supply chain, the threat expanded across multiple language ecosystems, prompting researchers to reframe the danger as http2shell. The revised assessment demonstrates that the issue is not confined to a single runtime or framework.

At the core of the exploit is a memory corruption flaw embedded in standard Brotli decompression routines spanning versions 1.0.3 through 1.2.0. By transmitting a maliciously constructed compressed stream to an affected server, an external attacker can induce an out-of-bounds memory write during the decoding stage without needing prior authentication. This low-level memory corruption can lead to unpredictable application states, crashes, or arbitrary execution of unauthorized code.

While early warnings focused strictly on Node.js runtimes, the blast radius encompasses Python environments using Brotli packages as well as modern runtimes like Bun. Any backend application or service that accepts inbound Brotli-compressed HTTP payloads or decodes external data streams remains exposed to potential compromise if using the unpatched library. The vulnerability is particularly dangerous because automated decompression is a common default setting across web servers.

The severity of http2shell lies in the potential for complete system takeover, remote command execution, and sensitive memory disclosure. Because decompression often occurs before deeper application logic or authentication checks validate an inbound request, web-facing endpoints can be triggered directly by unauthenticated actors on the public internet. This creates an immediate attack vector for malicious actors scanning network interfaces for vulnerable decoders.

Brotli compression is universally deployed across modern cloud architectures and content delivery networks to reduce bandwidth and accelerate web transfers. Its deep integration within standard HTTP handling stacks means that vulnerable decoder components often reside silently inside third-party dependencies, container base images, and embedded network libraries. Many organizations may be running vulnerable implementations without direct awareness that Brotli is present in their stack.

Security platform Aikido Security emphasized that identifying vulnerable services requires teams to trace deeply nested dependencies across diverse software stacks. Because runtime packages in Node and Python often bundle their own compiled C implementations of Brotli, standard top-level package audits may fail to catch vulnerable binaries embedded within lower layers. Comprehensive scanning across codebases, containers, and server dependencies is necessary to detect hidden exposures.

Development and operations teams are urged to audit external-facing endpoints that decode compressed data and rapidly update their Brotli decoders and parent runtimes. Security advisories recommend verifying whether container images and server dependencies have been rebuilt against patched upstream releases to neutralize the out-of-bounds write condition. In environments where immediate patching cannot occur, operators may evaluate temporarily restricting Brotli decompression on untrusted inputs.

As software maintainers across language ecosystems rush to release patched runtime updates, security teams anticipate that exploitation attempts may accelerate against lingering unpatched servers. The emergence of http2shell highlights once again how a solitary vulnerability in a ubiquitous compression routine can cascade into a widespread supply chain hazard across the internet. Organizations are expected to prioritize patching in the coming days as automated scanning tools and proof-of-concept tests propagate.