← All articles Blog

Node2Shell Becomes HTTP2Shell: A New Flaw Hits Node.js and Python After PHP2Shell

Hamza Tech · October 24, 2026 · 4 min read

Just days after the PHP2Shell flaws knocked government websites offline, another serious bug is forcing developers to patch fast. Researchers have named it Node2Shell, and it affects Node.js, the software behind a huge share of modern websites and apps, as well as Python tools. Security firms now say the same underlying flaw reaches further than first thought, calling the wider problem HTTP2Shell. Here is what the Node2Shell vulnerability is, who is at risk, and the exact versions that fix it.

🛑 ALERT – Node2Shell RCE exploit works on an official Node.js build.

Researchers demonstrated how crafted Brotli data can trigger code execution through vulnerable Node.js applications, without modifying the runtime.

Here's how the exploit works: https://t.co/ffJvHDqRXj pic.twitter.com/sLH83S7p9r
— The Hacker News (@TheHackersNews) October 23, 2026

What Is Node2Shell?

Node2Shell is the nickname for CVE-2026-111497, a memory flaw in Google’s Brotli library. Brotli is a popular compression format that shrinks data so websites load faster. The bug is an out-of-bounds write, meaning specially crafted compressed data can make the decoder write information outside the memory it is supposed to use, as Qualys explained.

Node.js describes the flaw as one that permits remote code execution, the most serious kind of security bug. The CVE record scores it 9.2 out of 10. It was found by researchers from OpenAI’s Codex Security team, the same group involved in finding the PHP2Shell bugs this week.

Why it reaches beyond Node.js

Because the bug sits in the Brotli library itself, any software that decodes untrusted Brotli data with an affected copy is exposed. Python is the clearest case. Popular Python packages that bundle the same decoder, and tools that rely on them, can also be affected. Security firm Aikido says the issue has evolved into a broader threat it calls HTTP2Shell, reflecting how widely Brotli is used across web software.

Who Is Actually at Risk?

Not every Node.js app is in danger. A service is exposed only if it, or a library it uses, decompresses Brotli data that an attacker controls, as Cycode noted. Common examples include:

Apps that accept compressed request bodies, such as some setups of the Express 5 web framework.
Server code that fetches data from untrusted websites and automatically decompresses the response.
Services that process uploaded compressed files.

A basic Node.js web server that does not decode Brotli requests is not automatically vulnerable, but checking is still essential.

The Fixed Versions

Updating is the real fix. Patched versions include:

Node.js 26.12.1, 24.22.1 and 22.23.4
Bun 1.4.4
Python Brotli 1.2.1 and brotlicffi 1.2.1.0
Google Brotli library 1.0.10, 1.1.1 and 1.2.1

Older Node.js lines, including 20.x, 23.x and 25.x, are past end of life and will not get a fix. Anyone still running them should move to a supported version.

How Urgent Is It?

Public proof-of-concept code appeared within about a day of the fix, and researchers demonstrated code execution on an official Node.js build. As of 23 October, the flaw had not been added to the US government’s list of known exploited vulnerabilities. That gives organisations a short window to patch before attacks become common, but it is a window, not a guarantee.

Interestingly, the fix was committed to Google’s Brotli code back in February, but no release or advisory followed until October. That gap is a reminder of how long security fixes can sit unnoticed in open-source projects.

What Developers and Site Owners Should Do

Check every Node.js and Python environment, including containers and servers that inventory tools may miss.
Update to a fixed version across all systems.
Reduce exposure while patching by rejecting Brotli-encoded requests at a proxy or load balancer, where practical.
Ask your hosting provider to confirm their platforms are patched.

This is the second major web security scare in a week, after the PHP2Shell flaws that took government sites offline. Our report on an AI-assisted supply chain attack shows another fast-moving threat. Our website security checklist guide covers wider steps.

Patch Before It Spreads

Node2Shell shows how one flaw in a shared library can ripple across millions of applications. With proof-of-concept code already public, delay is risky. Update Node.js, Bun and Python Brotli packages now, and confirm your hosting provider has done the same.

Frequently Asked Questions

Is my website affected by Node2Shell?

Only if it runs Node.js or Python code that decompresses untrusted Brotli data. Ask your developer or host to check.

Which Node.js versions fix Node2Shell?

Node.js 22.23.4, 24.22.1 and 26.12.1, along with newer patch releases in those lines.

Is Node2Shell being exploited?

Proof-of-concept code is public. As of 23 October, it had not been listed as actively exploited by the US government.

What is HTTP2Shell?

It is the name security firm Aikido uses for the wider risk created by the same Brotli flaw across different software.

← Back to all articles