What does HTTP2Shell mean?
CVE-2026-111497 was initially also discussed under the name Node2Shell. The name HTTP2Shell emphasises that a vulnerable Brotli component can exist in multiple runtimes and products, not only in a Node.js application.
The useful question when assessing exposure is specific: can an untrusted source send Brotli data to a vulnerable component that decompresses it? Knowing that a website uses HTTPS does not answer that question.
Why does it matter how the data travels?
The Node.js announcement describes an out-of-bounds write in a Brotli decoder buffer. Malformed compressed data can corrupt process memory, with effects including process termination, memory disclosure or code execution.
Compressing files sent by a website and decompressing incoming data are different operations. Trace both incoming requests and external responses processed by the application. A plugin name or server setting alone is not an inventory of all these data paths.
Node.js updates following disclosure
The Node.js project published updates for the 22.x, 24.x and 26.x branches on 21 October 2026. The table shows the first patched versions. Before implementation, also check subsequent recommendations, application compatibility and any fixes supplied separately by the hosting platform.
| Branch | First patched version |
|---|---|
| 22.x | 22.23.4 |
| 24.x | 24.22.1 |
| 26.x | 26.12.1 |
Check the Node.js environment used by the application
The command below displays the Node.js version, executable path and reported Brotli version. Run it in the application environment, including inside its container if applicable. It is not an exploit test and does not install updates.
node -p 'JSON.stringify({ node: process.versions.node, brotli: process.versions.brotli, executabil: process.execPath }, null, 2)'An already-running process may use a different executable from the one in your terminal. Compare the complete package against the vendor bulletin; the reported Brotli version alone does not establish whether it is vulnerable.
A hidden dependency calls for a better inventory
The AWS bulletin shows why managed services must be distinguished from customer-managed components and images. Patching a platform does not automatically update every custom image or environment bundled with an application.
We recommend checking the build environment, deployed image and running processes separately. Keep this inventory with the release documentation so that the next alert does not require starting again from scratch.
- Identify applications that decompress Brotli data from external sources.
- Check runtimes and libraries bundled into images or products.
- Apply the packages corrected according to the supplier's recommendations.
- Rebuild and redeploy your affected images.
- Confirm which version is actually running and test import and integration workflows.
What should be left after repair
A useful record links each application to the dependency checked, its running version and the test results. The team can then explain what it fixed and the evidence supporting that conclusion.
Filtering and monitoring can help during remediation. However, assess exposure and remediation against the specific component and identified data path, rather than the vulnerability’s popular name alone.
Sources and verification
The technical information was checked on 31 October 2026. Package status and vendor recommendations can change; consult the current announcement for the product in use before making changes.