node2shell / http2shell (CVE-2026-111497): Affected Versions and How to Patch Node and Python Sites

Key takeaway: node2shell, also called http2shell, is a nickname for CVE-2026-111497, a flaw in the Brotli decompression code used by Node.js and by Python’s Brotli packages. Node.js published fixes on 21 October 2026: 22.23.4, 24.22.1 and 26.12.1. If your site or app runs Node 22, 24 or 26, or has Python’s Brotli installed, check your version today. We found no confirmed attacks in the wild in the sources we read.

• Node.js: update to 22.23.4, 24.22.1 or 26.12.1 or later. Versions that are end of life, such as Node 20 and older, are affected and have no fix, so plan a move to a supported release.
• Python (per Aikido): upgrade Brotli to 1.2.1 and brotlicffi to 1.2.1.0.
• Not the same bug: “php2shell” is a separate PHP flaw with its own fix.

Research-based news. We haven’t run the exploit or tested any patch. Facts come from Node.js, NVD, CISA and others, checked 24 October 2026. Python and other-vendor details come from Aikido, a security vendor’s blog, so we label them as secondary.

“node2shell” and “http2shell” are community nicknames, not official names. The official identifier is CVE-2026-111497.

What node2shell / http2shell is

Brotli is a compression format that websites use to make pages smaller. The flaw is in the part that unpacks Brotli data. According to the Node.js advisory, malformed input can write past the end of an internal buffer. If an attacker can supply Brotli data that your app decompresses with node:zlib, they can corrupt memory, which can lead to a crash, a leak of process memory or remote code execution.

So the risk depends on whether your software decompresses data an outsider controls. A site that only sends Brotli to visitors is not the same case. The Node.js advisory notes that the same release fixes nine other vulnerabilities, which we don’t cover here.

How serious is it? Sources disagree

Nobody has settled on one number, so we don’t pick one:

Source	Rating
Node.js	“high”
Google (the CVE’s issuing authority, listed on NVD)	CVSS 4.0 score 9.2, critical
CSA (a national cyber agency), CVSS 3.1	9.8
CERT Santé (health-sector CERT), CVSS 3.1	8.1
NVD’s own analysis	Not scored yet (status “Awaiting Analysis” on 24 October)

Is my site affected? A 2-minute check

• Node.js: run node -v. Node 22, 24 and 26 releases before the fixed versions are affected. Check each server, container and hosting plan.
• Python (Aikido’s commands): run pip show Brotli brotlicffi in each environment and container. Aikido says versions 1.2.0 and earlier are affected, and that pipdeptree -r -p Brotli shows which package pulled it in. Aikido says common HTTP libraries, such as requests, httpx, aiohttp and Scrapy, can load Brotli when it is installed, so you may be exposed without importing it.
• PHP: run php -v (see the separate php2shell section below).
• Managed hosting: check your host’s status page or ask support which runtime patch level you have. Don’t assume it’s done.

Aikido also says that, as of 23 October, pip-audit, Dependabot and Safety did not flag the vulnerable PyPI packages, so a clean scan may not be an all-clear.

Fixed versions

Software	Fixed version	Source
Node.js	22.23.4, 24.22.1, 26.12.1	Node.js (official)
Python Brotli / brotlicffi	1.2.1 / 1.2.1.0	Aikido (secondary)
Bun	1.4.4	Aikido (secondary)
Envoy	1.40.0, 1.39.3, 1.38.6 or 1.37.8	Aikido (secondary)
Istio	1.29.9, 1.30.6 or 1.31.2	Aikido (secondary)
Google Brotli library (libbrotli)	1.0.10, 1.1.1 or 1.2.1	NVD ranges and Aikido

For anything other than Node.js, check the vendor’s own advisory before relying on this table. Aikido says Apache’s standard mod_brotli doesn’t decode Brotli. We haven’t verified whether its list of affected software is complete.

If you can’t patch today

Node.js’s advisory lists fixed releases and no workaround. These steps come from Aikido and aren’t official:

• Python: if you don’t need Brotli, uninstall Brotli and brotlicffi, then rebuild and restart. Aikido says HTTP clients fall back to gzip and deflate, though a server that sends Brotli anyway may cause an error.
• Inbound traffic: reject requests with Content-Encoding: br at your proxy or load balancer, before anything decodes them.
• Outbound requests: Aikido says removing br from Accept-Encoding is not enough, because a malicious server can send Brotli anyway.

If you want help with the routine side, automate your update reminders and uptime alerts so version checks don’t depend on someone remembering. Our n8n vs Make vs Zapier comparison covers tools for scheduled checks, and ChatGPT Team Tasks covers scheduled AI jobs for a team. That’s our own service, and it doesn’t patch servers for you.

Don’t mix it up with php2shell

The same week, a separate PHP flaw nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619) was fixed. CISA’s alert, revised 23 October, describes unauthenticated remote code execution in PHP installs that serve web requests. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are unsupported. CISA says it had not observed successful in-the-wild exploitation when it published. The PHP Foundation says its own CVSS score is 9.2, and that a leaked 10.0 was wrong.

What “Black October” means

The Guardian uses “Black October” for this week of AI-assisted vulnerability discovery. Its report covers PHP, not the Brotli bug. Node.js credits the Brotli report to “OpenAI Codex Security” researchers. We don’t draw wider conclusions here.

What’s still unconfirmed

• Attacks in the wild: none confirmed in the sources we read. Aikido says researchers, including Imperva, have shown exploitation against an unmodified Node.js 24.22.0 in a lab, and The Hacker News reported no in-the-wild exploitation (second-hand, via Aikido). Other write-ups we saw on 24 October also say none has been reported. Public exploit research makes attacks more likely, but isn’t evidence of them.
• NVD’s score: not assigned yet.
• Other vendors: we haven’t checked each vendor’s own advisory.

What we checked, and what we’ll test

We read Node.js’s advisory, the NVD record, Aikido’s write-up, CISA’s PHP alert and the PHP Foundation’s post on 24 October 2026. We haven’t run the exploit or a patch. We’ll update this page if NVD finishes its analysis or exploitation is reported.

FAQ

What is node2shell?

It’s a nickname for CVE-2026-111497, a Brotli decoder flaw in Node.js. http2shell is the name used once it was found to reach Python and other HTTP software.

Which Node.js versions fix it?

22.23.4, 24.22.1 and 26.12.1, per the Node.js advisory. End-of-life versions always count as affected.

Does it affect Python?

Aikido says yes: PyPI Brotli 1.2.0 and earlier and brotlicffi 1.2.0.x, fixed in 1.2.1 and 1.2.1.0. That’s a secondary source, so check the package’s own release notes too.

Is it being exploited?

No confirmed in-the-wild exploitation in the sources we read on 24 October 2026. Researchers have shown it can be exploited in lab conditions, per Aikido.

Is php2shell the same thing?

No. It’s a separate PHP bug with its own CVEs and fixes.