HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.js

The key point: CVE-2026-111497 now increasingly referred to as HTTP2Shell and initially reported as Node2Shell, is broader than a Node.js vulnerability. The vulnerability is associated with Brotli decompression, so defenders need to find vulnerable implementations across applications and infrastructure, confirm whether untrusted compressed data can reach them, and patch the affected component.

· CVE: CVE-2026-111497

· Affected layer: Brotli decompression implementations used by multiple runtimes and infrastructure components

· Primary risk question: Can attacker-controlled Brotli-compressed data reach a vulnerable decoder?

· Immediate priority: Discover, assess reachability, patch, redeploy, and hunt

Context

HTTP2Shell emerged shortly after PHP2Shell, but the vulnerabilities are technically unrelated. The connection is operational: both affect widely used foundational technology that can be embedded beneath many applications. This makes dependency visibility as important as application inventory.

The issue first gained attention as Node2Shell because Node.js was an obvious exposure path. The broader concern is that vulnerable Brotli code may also appear in other runtimes, packages, proxies, service-mesh components, and container images. The name HTTP2Shell does not mean the HTTP/2 protocol itself is vulnerable.

Confirmed exploitation in the wild: On October 27, 2026, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Organizations should prioritize remediation of reachable, affected systems. Read CISA’s announcement.

What We See

• The initial Node.js-focused view is too narrow. Security teams need to search across application, cloud, container, and infrastructure environments.
• The presence of vulnerable code is not enough to determine priority. Reachability matters: untrusted compressed requests, external responses, files, or other data must be able to reach the decoder.
• Internet-facing services and systems that automatically decompress external Brotli data should be assessed first.

What Our Telemetry Shows

Check Point IPS (Intrusion Prevention System) telemetry associated with Node.js Brotli Remote Code Execution (CVE-2026-111497) shows automated vulnerability scanning and suspicious payloads potentially associated with exploitation.

Scope of the percentages: All percentages below refer to the telemetry data analyzed for this assessment, not to all exploitation attempts or global activity.

• Brotli-focused activity (90.5%): Requests contained Brotli-encoded HTTP payloads, consistent with vulnerability-focused testing.
• Automated vulnerability scanning (33.8%): Events contained the Patrowl automation fingerprint, indicating systematic vulnerability probing.
• Targeted endpoint probing (24.5%): Requests targeted upload and ingestion endpoints, suggesting focused vulnerability testing.
• Exploitation indicators: Malformed binary payloads, unusual HTTP framing, and HTTP 500 server errors were observed, warranting further investigation but not confirming successful exploitation.

Overall assessment: The findings indicate widespread automated vulnerability probing alongside suspicious payload activity. Continued research and protection development are recommended. CISA’s confirmation of exploitation in the wild is separate from these telemetry findings, which do not establish successful compromise in the observed events.

What We Found

The practical exposure model has two parts:

• Vulnerable component: an affected Brotli implementation exists in the application or supporting infrastructure.
• Attacker reachability: attacker-controlled Brotli-compressed data can reach that implementation.

Potentially relevant environments include Node.js, Python Brotli packages, Bun, .NET, Envoy, Istio, and software that bundles or statically links affected Brotli code. Product-specific impact and fixed versions should be confirmed against the relevant vendor advisory before deployment changes are made.

How Check Point Helps Protect Organizations

Patching the affected component remains the primary remediation. Check Point controls can add visibility and risk reduction before, during, and after remediation:

IPS protection: Check Point IPS provides dedicated protection against this vulnerability with “Node.js Brotli Remote Code Execution (CVE-2026-111497)”.

• Network and application prevention: keep Check Point security protections and signatures current, and use prevention policies appropriate to the environment.
• Web application and API security: inspect and restrict unnecessary compressed request paths, especially where applications do not need Brotli-encoded request bodies.
• Exposure management: identify affected assets, prioritize internet-facing and reachable exposure, validate exploitability where supported, and track remediation.
• Endpoint and workload detection: investigate crashes, restarts, suspicious child processes, unexpected network activity, and decompression errors on exposed systems.

Explore relevant Check Point capabilities: Check Point cyber security products | Vulnerability Response Point

What Your Security Teams Needs toDo Now

• Expand discovery beyond Node.js. Inventory Brotli implementations in runtimes, packages, proxies, service meshes, containers, and statically linked software.
• Test reachability. Identify where untrusted compressed requests, responses, files, or fetched content can reach a vulnerable decoder.
• Patch by vendor and component. Apply the relevant vendor update, rebuild affected container images, and redeploy running workloads. Verify that production is using the patched component.
• Reduce exposure if patching must wait. Disable unnecessary Brotli decompression for untrusted input, reject Brotli-encoded requests where they are not required, and restrict exposed services. Treat these as temporary measures.
• Hunt while remediating. Prioritize internet-facing and unpatched systems. Review application crashes, repeated restarts, suspicious processes, anomalous outbound traffic, and Brotli decompression errors.
• Keep the assessment open. Re-check software inventories and vendor advisories as affected-product guidance develops. Do not close the incident after patching Node.js alone.

Follow the Latest Guidance

For a continuously updated practitioner view of emerging vulnerabilities, affected technologies, protections, and remediation guidance, visit the Check Point Vulnerability Response Point.

For the preceding vulnerability story, read PHP2Shell: What We Know About the Leaked Critical PHP Vulnerabilities.

Check Point Research | HTTP2Shell practical follow-up