HTTP2Shell: critical Brotli decoder flaw CVE-2026-111497

An out-of-bounds write in Google's Brotli decoder 1.0.3–1.2.0, tracked as CVE-2026-111497 and dubbed HTTP2Shell, carries a CVSS score of 9.2 and can cause crashes, memory disclosure and remote code execution. It is fixed in Brotli 1.2.1, Node.js 22.23.4/24.22.1/26.12.1 and Bun 1.4.4.

• CVSS 9.2 out-of-bounds write in DecodeBlockTypeAndLength in Brotli 1.0.3–1.2.0
• Fixed in Brotli 1.2.1, brotlicffi 1.2.1.0, Node.js 22.23.4/24.22.1/26.12.1, Bun 1.4.4
• pip-audit, Dependabot and Safety missed vulnerable Python packages until CVE mapping landed
• Triggered by decoding Content-Encoding: br from an untrusted peer