The Eight-Month-Old Bug That Forced the Whole Web to Patch at Once
It Was Never About HTTP/2
Despite the name, HTTP2Shell has nothing to do with the HTTP/2 protocol itself. The flaw sits in the C decoder of Google's Brotli compression library: a crafted compressed stream drives the decoder's block-type state machine into an invalid state and writes past a buffer. A process that decompresses attacker-controlled Brotli data can crash, leak memory, or, under the right conditions, hand over remote code execution. Aikido Security coined the HTTP2Shell label because Brotli is lodged inside nearly the entire HTTP ecosystem — the name is theatrics, the blast radius is not.
One CVE, Three Nicknames, a 9.2 Score
Fixed in February, Shipped in October
The most remarkable detail, documented by WebProNews, is that the upstream fix had been committed to Brotli's source tree since February — yet no release carried it until October 21, when Node.js and Google shipped synchronized stable fixes, with public disclosure the next day and the PyPI package following on October 23. For roughly eight months the patch sat in a public commit waiting to be packaged. Node.js moved its three supported lines to 22.23.4, 24.22.1 and 26.12.1, while the library itself went to 1.2.1, with 1.1.1 and 1.0.10 covering the older series.
The Victim List Goes Far Beyond Node
Code Execution Proven, In-the-Wild Attacks Unreported
Imperva's Red Team reported on October 22 that it demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image — no instrumented build required, though several attempts were needed — while the same input was rejected by the fixed 24.22.1. Crash, memory disclosure and shell are therefore all on the table. As of October 25, however, no attacks in the wild had been publicly reported, so defenders still have a patching window. One clarification: the Citrix NetScaler zero-days Google warned about in late September are a separate incident and should not be conflated with this Brotli flaw.
Find Every Copy First, Then Patch
Tanium and several other outlets prescribe the same order of operations: inventory every bundled copy of Brotli first, because updating the system library does not fix applications that ship their own copy — and plenty do. Teams that cannot patch immediately should block incoming Brotli-compressed traffic at a proxy or firewall, or disable Brotli decoding; merely removing br from Accept-Encoding is not enough, since a server may send it anyway. With Node.js 26 set to become long-term support on October 28, upgrades can ride along. The lesson of the eight-month gap is uncomfortable: the fix existed, the release did not.
