Taiwan Information Security Association
Join TWISA
Menu

Exploited vulnerabilitySun, 25 Oct 2026

HTTP2Shell: patch Brotli decoders on both HTTP paths

CVE-2026-111497 was added to CISA’s Known Exploited Vulnerabilities catalog. Check inbound requests and outbound HTTP clients that decompress untrusted Brotli content.

Download PDF (Traditional Chinese)View applicable solutionsBack to Security alerts
01

Article

The Canadian Centre for Cyber Security reports that CISA added the CVE on October 27. Google’s CNA assigned CVSS v4.0 9.2 and Amazon Linux assigned CVSS v3.1 8.1. Node.js rated it High and issued its update on October 21. A vulnerable decoder must actually decompress attacker-controlled Brotli data. Imperva demonstrated code execution through request and response paths in the official Node.js 24.22.0 Linux arm64 image. Version 24.22.1 rejected the same input.

Reject incoming Content-Encoding values containing br before a vulnerable decoder runs, including mixed case and multiple encodings. On outbound clients, remove br from Accept-Encoding and disable Brotli decompression or reject br responses before automatic decoding. A server can return Brotli without negotiation. Check .NET and Lambda vendor guidance and rebuild self-contained or container deployments where required.

Fixed releases by branch
  • Google Brotli 1.0.10 / 1.1.1 / 1.2.1
  • Node.js 22.23.4 / 24.22.1 / 26.12.1
  • Python brotli 1.2.1 / brotlicffi 1.2.1.0
  • Bun 1.4.4
  • Envoy 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8 (legacy: 1.36.12)
  • Istio 1.31.2 / 1.30.6 (legacy: 1.29.9)
Attack flowAttack path
  1. 01

    Send a compressed request or response

  2. 02

    Trigger a vulnerable Brotli decoder

  3. 03

    Crash the process, expose memory or execute code

Response flowResponse steps
  1. 01

    Inventory both decompression paths

    Identify the loaded decoder in web services, clients, proxies and containers. Prioritize untrusted inputs.

    See what to doResources: 1

    TWISA member solutions

    Inventory both decompression paths

    Identify the loaded decoder in web services, clients, proxies and containers. Prioritize untrusted inputs.

  2. 02

    Restrict inbound compressed requests

    Block br before decoding and verify direct backend paths.

    See what to doResources: 2

    TWISA member solutions

    Restrict inbound compressed requests

    Block br before decoding and verify direct backend paths.

  3. 03

    Patch deployed components

    Update runtimes and bindings, rebuild containers and embedded binaries, and restart or redeploy.

    View guidanceResources: 3

    Response guidance

    Patch deployed components

    Update runtimes and bindings, rebuild containers and embedded binaries, and restart or redeploy.

  4. 04

    Test both HTTP paths and verify recovery

    Use authorized tests to check incoming requests and outgoing responses separately. Compare WAF alerts, blocks and backend results.

    See what to doResources: 2

    TWISA member solutions

    Test both HTTP paths and verify recovery

    Use authorized tests to check incoming requests and outgoing responses separately. Compare WAF alerts, blocks and backend results.

Defense architectureLayered defenses

Allow authorized traffic and apply controls at each layer.

  1. 01

    Inventory both decompression paths

    Identify the loaded decoder in web services, clients, proxies and containers. Prioritize untrusted inputs.

  2. 02

    Restrict inbound compressed requests

    Block br before decoding and verify direct backend paths.

  3. 03

    Patch deployed components

    Update runtimes and bindings, rebuild containers and embedded binaries, and restart or redeploy.

Feed logs and traffic data from each layer into monitoring and response.

  1. Test both HTTP paths and verify recoveryUse authorized tests to check incoming requests and outgoing responses separately. Compare WAF alerts, blocks and backend results.

TWISA member solutions

Sources and further reading

Alert updated: 2026/10/29. Check vendor guidance for the latest support and patch status.