# Broccoli2Shell - HTTP2SHELL (CVE-2026-111497) Fix Tracker

> Day-by-day vulnerable vs fixed status for CVE-2026-111497, also known as Broccoli2Shell, HTTP2Shell and Node2Shell: an out-of-bounds write in the Google Brotli decoder (c/dec/decode.c) affecting Brotli 1.0.3 to 1.2.0. Maintained by Phoenix Security. Last updated 27 October 2026.

Key facts:
- Vulnerable: Google Brotli 1.0.3 to 1.2.0. Fixed: 1.0.10, 1.1.1, 1.2.1 (21 October 2026).
- Node.js fixed in 22.23.4, 24.22.1, 26.12.1 (21 October 2026). Node.js 20, 23, 25 are end of life with no fix.
- Bun 1.0.21–1.4.3 affected, fixed in 1.4.4. Python Brotli 1.2.1, brotlicffi 1.2.1.0. .NET runtime 8.0.33, 9.0.22, 10.0.14, 11.0.0-rc.3 (SDK 8.0.427/8.0.133, 9.0.320/9.0.123, 10.0.403/10.0.114), 25 October 2026; Brotli decoding is off by default in .NET, so exposure needs an opt-in. Visual Studio 18.11.2, 17.14.43, 16.11.61; PowerShell 7.6.9, 7.5.13, 7.4.22. Envoy 1.40.0, 1.39.3, 1.38.6, 1.37.8. Istio 1.29.9, 1.30.6, 1.31.2.
- Ubuntu 22.04–26.10 fixed by USN-8956-1 (24.04: libbrotli1 1.1.0-2ubuntu0.1); 16.04–20.04 still need evaluation.
- Severity: CVSS 4.0 9.2 Critical (Google CNA; GitHub, OSV, NVD); Microsoft CVSS 3.1 8.1 (AV:N/AC:H) for .NET, Critical for .NET and Visual Studio, Important for PowerShell; Red Hat Important; Node.js High; Ubuntu Medium.
- Exploitation: the first public PoC reached RCE only on a deliberately weakened build; standard builds crash. Imperva reported unreliable RCE on official Node.js 24.22.0 linux-arm64. Microsoft: publicly disclosed, not exploited, exploitation more likely.
- As of 27 October 2026: 83 products tracked; 42 fixed, 12 fix in progress, 17 vulnerable with no fix, 5 no vendor statement, 3 not affected, 4 WAF mitigations live.
- Mitigation if you cannot upgrade: reject inbound Content-Encoding br (case-insensitive, including in lists); remove br from outbound Accept-Encoding and reject br responses before decoding. Cloudflare managed WAF rules ship in Log mode (override to Block); Azure WAF DRS 2.2 rule 920450 blocks in Prevention mode.

## Primary analysis
- [Phoenix Security: HTTP2Shell / Node2Shell analysis](https://phoenix.security/http2shell-node2shell-cve-2026-111497-brotli-decoder-out-of-bounds-write/)
- [Phoenix Security: HTTP2Shell expansion, bundled Brotli copies](https://phoenix.security/http2shell-expansion-cve-2026-111497-brotli-bundled-copies/)
- [Interactive tracker](https://http2shell.pplx.app/)

## Status by product family (27 October 2026)

### Upstream Brotli (C library)
- Brotli 1.2.x: affected 1.2.0; fixed 1.2.1; status Fixed. Tagged 21 Oct, about 19:27 UTC. The fix is commit 0ed4268 from 27 Feb, which nobody had recognised as a security fix.
- Brotli 1.1.x: affected 1.1.0; fixed 1.1.1; status Fixed. Backport branch release.
- Brotli 1.0.x: affected 1.0.3 – 1.0.9; fixed 1.0.10; status Fixed. The vulnerable early return first appears in 1.0.3.
- Brotli ≤ 1.0.2: affected —; fixed n/a; status Not affected. Below the CVE's affected range (1.0.3 is the lower bound).

### JavaScript runtimes
- Node.js 26.x: affected < 26.12.1; fixed 26.12.1; status Fixed. Published 21 Oct, 10:38 UTC. process.versions.brotli still reports 1.2.0 (cherry-picked fix), so check the Node version instead.
- Node.js 24.x LTS: affected < 24.22.1; fixed 24.22.1; status Fixed. Imperva demonstrated RCE on 24.22.0 linux/arm64.
- Node.js 22.x LTS: affected < 22.23.4; fixed 22.23.4; status Fixed.
- Node.js 20 / 23 / 25 (EOL): affected all; fixed none; status Vulnerable, no fix. End-of-life lines get no fix. Move to 22, 24 or 26.
- Docker official node images: affected tags before fixed builds; fixed 22.23.4 · 24.22.1 · 26.12.1; status Fixed. Slim tags were pushed 21 Oct and full/Alpine tags 22 Oct. Cached base layers stay vulnerable until you pull fresh and rebuild.
- Bun: affected 1.0.21 – 1.4.3; fixed 1.4.4; status Fixed. Released 22 Oct, 10:11 UTC, with Brotli 1.2.1. Rebuild any bun build --compile executables.
- Electron 42+ (Chromium 148+): affected —; fixed carried via Chromium 148; status Fixed. Tanium says Electron builds Node against Chromium's Brotli. Electron has made no statement, and its release index still lists Node 24.22.0 / 24.19.0.
- Electron ≤ 41 apps: affected ≤ 41.x; fixed app vendor update; status Vulnerable, no fix. Needs a vendor rebuild on a supported Electron version. Check desktop apps such as Slack, Discord and Signal.
- GraalJS (graal-nodejs): affected ≤ 25.4.4.1.1; fixed master (unreleased); status Fix in progress. Merged to master 22 Oct. GraalVM ships quarterly, so there is no release yet.
- Deno: affected —; fixed n/a; status Not affected. Uses the Rust brotli-decompressor, not the C decoder.

### Python packages
- PyPI Brotli: affected 1.0.3 – 1.2.0; fixed 1.2.1; status Fixed. PYSEC-2026-4322; published 22 Oct, 13:57 UTC. Just having it installed makes requests/urllib3, httpx and aiohttp decode br.
- PyPI brotlicffi: affected < 1.2.1.0; fixed 1.2.1.0; status Fixed. PYSEC-2026-4323; published 22 Oct, 16:19 UTC.
- Wheels with vendored decoders: affected latest releases; fixed none yet; status Vulnerable, no fix. 19 popular packages, including Pillow, pyarrow, curl-cffi, pycurl, tensorflow and jaxlib. pip show Brotli won't reveal these copies, and PyPI/OSV don't list them.
- brotlipy (abandoned): affected all; fixed none; status Vulnerable, no fix. When installed, it can shadow a fixed Brotli at import time. Uninstall it.

### Other language runtimes & bindings
- .NET 8 / 9 / 10 (+ 11 RC): affected runtime < 8.0.33 · < 9.0.22 · < 10.0.14; fixed runtime 8.0.33 · 9.0.22 · 10.0.14 · 11.0.0-rc.3 — SDK 8.0.133/8.0.427 · 9.0.123/9.0.320 · 10.0.114/10.0.403; status Fixed. Out-of-band release 25 Oct. Off by default: ASP.NET Core request decompression and HttpClient automatic decompression are not enabled unless you opt in, or call BrotliStream/BrotliDecoder directly. Microsoft scores it CVSS 3.1 8.1 (AC:H). NativeAOT and self-contained apps must be rebuilt. .NET Framework is not affected.
- Visual Studio 2019 / 2022 / 2026: affected < 16.11.61 · < 17.14.43 · < 18.11.2; fixed 16.11.61 · 17.14.43 · 18.11.2; status Fixed. Patched alongside .NET on 25 Oct. Microsoft rates it Critical for Visual Studio.
- PowerShell 7.4 / 7.5 / 7.6: affected < 7.4.22 · < 7.5.13 · < 7.6.9; fixed 7.4.22 · 7.5.13 · 7.6.9; status Fixed. Patched 25 Oct. Microsoft rates it Important for PowerShell.
- Java brotli4j (Netty): affected < 1.24.0; fixed 1.24.0; status Fixed. 1.24.0 bundles Brotli 1.2.1.
- Ruby brotli gem: affected < 0.9.1; fixed 0.9.1; status Fixed. On RubyGems 24 Oct, 05:31 UTC. Refuses an unpatched system libbrotli.
- PHP brotli extension: affected < 0.21.1; fixed 0.21.1; status Fixed. Bundles Brotli 1.2.1. Reached via brotli_uncompress().
- Perl IO::Compress::Brotli: affected 0.004001 – < 0.023; fixed 0.023; status Fixed. Tracked as CVE-2026-115936. The bundled copy means a system libbrotli update does not fix it.
- Go andybalholm/brotli: affected < v1.2.7; fixed v1.2.7; status Fixed. Separate implementation of the same logic flaw, likely crash-only. Release date not stated; listed as fixed by 24 Oct. Used by Traefik and Caddy plugins.

### Proxies, service mesh & web servers
- Envoy 1.37 – 1.40: affected 1.39.2 · 1.38.5 · 1.37.7; fixed 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8; status Fixed. Fixed releases shipped quietly on 6 Oct; the advisory followed 23 Oct. Only affected when the Brotli decompressor filter is configured.
- Envoy 1.36 (unsupported): affected 1.36.11; fixed 1.36.12; status Fixed. Has the fix, but the branch is unsupported. Move to a supported branch.
- Istio 1.30 / 1.31: affected 1.31.0–1.31.1 · 1.30.0–1.30.5; fixed 1.30.6 · 1.31.2; status Fixed. Only affected when Brotli decompression is enabled (for example via EnvoyFilter).
- Istio 1.29 (EOL): affected 1.29.0 – 1.29.8; fixed 1.29.9 (final); status Fixed. 1.29 reached end of life 15 Oct. Move to a supported line.
- ngx_brotli module: affected builds on Brotli < 1.2.1; fixed submodule → 1.2.1 (no tag); status Fixed. Submodule updated 22 Oct with no release tag; rebuild the module. Mostly compresses, so the decoder is rarely reached.
- nginx official Docker images: affected libbrotli1 1.1.0-2+b7; fixed rebuild pending; status Vulnerable, no fix. nginx itself doesn't decode Brotli, but images used as application bases inherit the library.
- Apache mod_brotli / nginx core: affected —; fixed n/a; status Not affected. Neither decodes Brotli by default.

### HTTP clients, dev tools & apps
- curl for Windows (static): affected < 8.23.0_4; fixed 8.23.0_4; status Fixed. Release date not stated; listed as fixed by 24 Oct. Distro libcurl follows the system libbrotli.
- Git for Windows: affected 2.56.0.windows.3 (Brotli 1.2.0); fixed none yet; status Vulnerable, no fix. Released 22 Oct still listing brotli 1.2.0-1.
- VS Code Server: affected < 1.143.1; fixed 1.143.1; status Fixed. Bundles Node 24.22.1. Date not stated; listed as fixed by 24 Oct.
- Kibana 9.5 / 9.4 / 8.19: affected 9.5.5 · 9.4.8 · 8.19.23 (Node 24.21.0); fixed next patch (Node 24.22.1); status Fix in progress. Branches were bumped 21 Oct, but no fixed artifact has been published. Issue #299985 is open.
- UEFITool: affected < A76; fixed A76; status Fixed. Bundles Brotli 1.2.1.
- EDK II firmware: affected bundled 1.2.0; fixed issue #13378; status Vulnerable, no fix. Decodes compressed firmware sections. Cherry-pick 0ed4268.
- MuPDF: affected 1.27.x and earlier; fixed 1.28.0; status Fixed. Fixed: 1.28.x picked up the upstream fix in April. Upgrade from 1.27.x, which is not being patched.
- 7-Zip-zstd · p7zip: affected bundled 1.2.0 · 1.0.9; fixed none yet; status Vulnerable, no fix. Reached when a user opens a .br file or archive. 7-Zip-zstd tracks it as issue #579.
- NanaZip: affected ≤ 7.0.1873.0; fixed main 3da1c6a (unreleased); status Fix in progress. Fixed on main; release pending. Date shows when it was first observed.
- libjxl: affected ≤ v0.12.0; fixed main PR #5062 (unreleased); status Fix in progress. Fixed on main; release pending.
- woff2 (Makefile build) · v8-jsi: affected bundled 1.0.3 · 1.2.0; fixed none yet; status Vulnerable, no fix. The woff2 CMake build links the system library instead (issue #207).

### Databases & data engines
- DuckDB: affected vendored 1.1.0; fixed PR #27791 (open); status Fix in progress. Reached by decoding Brotli-compressed Parquet. Fix PR opened 25 Oct.
- ClickHouse: affected own fork; fixed PR #127419 (open); status Fix in progress. Reached through HTTP bodies, files and Parquet.
- YDB: affected bundled; fixed main 343f6be (unreleased); status Fix in progress. Fixed on main 23 Oct; release pending.
- Apache Arrow / pyarrow: affected bundled 1.0.9; fixed issue #55166; status Vulnerable, no fix. Brotli-compressed Parquet. Only an issue is open; there is no fix yet.

### Browsers
- Chrome / Edge / WebView2 148+: affected < 148; fixed 148.0.7778.96+; status Fixed. Chrome has carried the fix since 5 May. Edge and WebView2 are inferred from Chromium.
- Firefox 150 · ESR 140.10 · ESR 115.35: affected < 150 (non-ESR); fixed 150 · 140.10 · 115.35; status Fixed. Fixed before disclosure (MFSA 2026-30). Thunderbird is inferred.
- RHEL Firefox / Thunderbird pkgs: affected RHEL 8 / 9 / 10; fixed none listed; status Vulnerable, no fix. Red Hat lists these as affected. Amazon Linux lists its Firefox as not affected.

### Linux distributions & package managers
- Debian 12 / 13: affected 1.0.9-2 · 1.1.0-2; fixed 1.0.9-2+deb12u1 · 1.1.0-2+deb13u1; status Fixed. DSA-6582-1. Debian's nodejs uses the system Brotli, so the brotli update fixes Node too. Restart processes afterwards.
- Debian sid: affected 1.2.0-4; fixed 1.2.0-4.1; status Fixed.
- Debian forky (testing): affected 1.2.0-4; fixed none yet; status Vulnerable, no fix. Waiting to migrate from sid.
- Alpine 3.21 – 3.24, edge: affected brotli < fixed; fixed 1.1.1-r0 · 1.2.1-r0; status Fixed. 1.1.1-r0 for 3.21/3.22 and 1.2.1-r0 for 3.23/3.24/edge. nodejs-current 26.12.1-r0.
- Ubuntu 22.04 – 26.10 brotli: affected 1.0.9-2 · 1.1.0-2 · 1.2.0-3 · 1.2.0-4; fixed 1.0.9-2ubuntu0.1 · 1.1.0-2ubuntu0.1 · 1.2.0-3ubuntu0.1 · 1.2.0-4ubuntu0.1; status Fixed. USN-8956-1, 26 Oct. 24.04 LTS is fixed in libbrotli1 1.1.0-2ubuntu0.1. Ubuntu priority: Medium.
- Ubuntu 16.04 – 20.04 brotli: affected 1.0.x; fixed none listed; status No vendor statement. Still "Needs evaluation" on Ubuntu's tracker as of 27 Oct.
- Ubuntu 20.04 nodejs: affected vendored Brotli; fixed none listed; status Vulnerable, no fix. On 22.04 and later, nodejs uses the system Brotli.
- RHEL 8 / 9 / 10: affected brotli · nodejs; fixed no erratum; status Vulnerable, no fix. Rated Important. RHEL 8 nodejs:24 bundles Brotli 1.2.0 in libnode.so, which is under re-evaluation in Bugzilla.
- Red Hat Hardened Images: affected —; fixed RHSA-2026:87420; status Fixed. Red Hat's only fixed product so far.
- OpenShift 4 / Satellite 6: affected bundled Brotli; fixed no erratum; status Vulnerable, no fix. Listed as affected, with no errata.
- Fedora Rawhide / ELN: affected brotli < 1.2.1; fixed 1.2.1; status Fixed.
- Fedora 45: affected brotli < 1.2.1; fixed brotli-1.2.1-1.fc45; status Fix in progress. FEDORA-2026-6a639d1308 is in updates-testing.
- Fedora 43 / 44: affected brotli < 1.2.1; fixed none yet; status Vulnerable, no fix.
- openSUSE Tumbleweed: affected brotli · nodejs24; fixed 1.2.1-1.1 · 24.22.1-1.1; status Fixed. openSUSE-Tumbleweed-2026-12232 / 12248.
- SLES 15 SP6 / SP7 nodejs22: affected < 22.23.4; fixed 22.23.4-150700.3.21.1; status Fix in progress. SUSE lists it as in QA. Its other Node and brotli packages are still under analysis.
- Amazon Linux 2023 brotli · nodejs24: affected —; fixed ALAS2023-2026-3334 · -3330; status Fixed.
- Amazon Linux 2023 nodejs / nodejs20: affected all; fixed No Fix Planned; status Vulnerable, no fix. Move to the nodejs24 package.
- Amazon Linux 2027 Preview: affected brotli · nodejs24; fixed Pending Fix; status Fix in progress.
- Homebrew brotli + node: affected brotli < 1.2.1; fixed 1.2.1 · node 26.12.1 · @24 · @22; status Fixed. Bottles published 22 Oct. Node formulas link the shared brotli formula.

### Cloud & hosting platforms
- Azure App Service (Linux): affected built-in Node; fixed 22.23.4 · 24.22.1; status Fixed. Rollout complete on both release channels 22 Oct.
- Azure Functions (Linux): affected built-in Node; fixed patched runtime; status Fixed. Rollout reported complete 24 Oct.
- Azure App Service / Functions (Windows): affected built-in Node; fixed 22.23.4 · 24.22.1; status Fix in progress. Rollout started 22 Oct and is not complete. A Windows Consumption host still ran Node 24.19.0 on 23 Oct.
- Heroku: affected older buildpacks; fixed 26.12.1 · 24.22.1 · 22.23.4; status Fixed. Available 21 Oct; you must redeploy to pick it up.
- Vercel managed runtimes: affected 22.x / 24.x / 20.x; fixed patched runtime rollout; status Fix in progress. Rollout in progress. Node 20 projects must move to 22/24.
- AWS Lambda managed runtimes: affected nodejs22.x / 24.x; fixed depends on update mode; status No vendor statement. No AWS bulletin found. Auto mode updates on its own; Function update and Manual modes, and container images, need action.
- Google Cloud Run / Functions: affected nodejs22 / 24; fixed —; status No vendor statement. No issue-specific notice found.
- Netlify · Render: affected —; fixed —; status No vendor statement. No issue-specific notice found. Render defaults new services to a pre-fix 24.x unless you pin a version.
- Cloudflare Workers (workerd): affected node:zlib Brotli; fixed —; status No vendor statement. Cloudflare has published WAF rules but no runtime statement.

### Edge mitigations (inbound only)
- Vercel WAF: affected —; fixed managed rules; status WAF mitigation live. Deployed 21 Oct. Does not cover responses your code fetches.
- Imperva WAF: affected —; fixed rule; status WAF mitigation live. Rule announced alongside Imperva's 22 Oct research post.
- Azure WAF (App GW / Front Door): affected —; fixed DRS 2.2 rule 920450 + custom rule; status WAF mitigation live. Rule 920450 blocks in Prevention mode. A custom regex rule covers older rulesets and Front Door Standard.
- Cloudflare Managed Ruleset: affected —; fixed …ca706f3c · …402fe5bb; status WAF mitigation live. Both rules ship in Log mode by default. Override to Block.