Free HTTP2Shell scanner - check for CVE-2026-111497

How the HTTP2Shell scan works, in short: a few small requests show how each endpoint handles normal and malformed Brotli. Only endpoints that decode Brotli request bodies then receive a stream of about 23 MB, which a patched decoder rejects and a vulnerable one accepts. If the probe can't tell, the scanner falls back to version checks for Envoy, Node.js, and Bun.

Probe matches are marked with Certain confidence and include the full request and response, so you can verify them yourself. For every step and what each result type means, see how we detect Node2Shell.

Before you scan production: endpoints that decode Brotli request bodies receive an upload of about 23 MB. Plan for the bandwidth and any request-size alerts.

Behind a WAF or CDN: if it rejects Brotli-encoded request bodies, the probe can't reach the decoder. A clean result from behind one doesn't prove you're patched, so confirm the version inside the workload.

1. List Brotli packages in every Python environment. Run this in each virtual environment and inside each container image, since images carry their own environments:

   pip show brotli brotlicffi

   Copy

   Anything below Brotli 1.2.1 or brotlicffi 1.2.1.0 needs an update.

2. Search lockfiles for the packages and the extras that pull them in. urllib3[brotli], httpx[brotli], aiohttp[speedups], and Scrapy all install Brotli without anyone importing it:

   grep -RniE "brotli|speedups|scrapy" \
     --include="requirements*.txt" --include="poetry.lock" \
     --include="uv.lock" --include="Pipfile.lock" .

   Copy

3. Find Node.js and Bun code that fetches user-supplied URLs. Search for fetch() calls and trace where each URL comes from. Prioritize webhooks, link previews, and importers.

4. Confirm runtime versions inside running workloads. Check what actually runs, since a patched host can still run old containers:

   node -v
   bun --version
   envoy --version

   Copy

5. Check other Brotli bindings in your stack. Java's brotli4j is fixed in 1.24.0.

6. Rebuild and redeploy. Update base images and wheels, rebuild every image that bundles the decoder, then rerun steps 1 and 4 against the new images.

Need a quick win before the rebuild? Where Brotli support is optional, uninstall Brotli and brotlicffi. urllib3, requests, and aiohttp then fall back to gzip and deflate.

Technical details

CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder (c/dec/decode.c), versions 1.0.3 through 1.2.0.

Brotli is a standard compression format on the web, so many runtimes and libraries ship their own copy of the C decoder. Node.js and Bun compile it into the runtime binary, Envoy uses it in its HTTP decompressor filter, and Python's Brotli and brotlicffi packages bundle it in their wheels. Each copy needs its own fix, which is why patching one ecosystem leaves the others exposed.

A crafted Brotli stream can corrupt memory. Depending on the input and the code path, that means a crash, a leak of process memory, or remote code execution with the privileges of the process doing the decoding.

One bug, four names

Despite the name, HTTP2Shell has nothing to do with the HTTP/2 protocol. Any attacker-controlled Brotli stream that reaches an affected decoder can trigger it. In tickets and reports, use the CVE ID - CVE-2026-111497 - so every team tracks one issue.

Versions vulnerable to HTTP2Shell

Sources: Node.js, Bun 1.4.4, Envoy releases, Istio bulletin 2026-007, Brotli 1.2.1.

Version numbers only provide a partial view of HTTP2Shell exposure. Container images pin the runtime and wheels they were built with, and some distribution packages lag behind upstream releases. Check what runs inside each workload, then rebuild.

HTTP2Shell severity score unpacked

Google, the CVE Numbering Authority for Brotli, gives CVE-2026-111497 a CVSS v4.0 base score of 9.2 (Critical). The Node.js project rates it High in its own advisory.

The critical rating reflects three things:

• No authentication required: a remote attacker only needs a Brotli stream to reach the decoder.
• No user interaction required: nobody on the target side needs to click or approve anything.
• Reach across stacks: any application on a vulnerable decoder inherits the flaw, whatever language or framework sits on top.

If leadership asks, here's the executive summary: every unpatched service that decodes untrusted Brotli, in either direction, is a candidate for remote code execution. Services that never decode Brotli can't be reached through this flaw today, and they still need the upgrade, because the next dependency update can add a decoding path.

HTTP2Shell disclosure timeline

Upgrade paths:

Our Network Vulnerability Scanner is a well-rounded tool for all your network security assessments.

It combines multiple engines and fine-tuned scan settings that surface more than 17,500 vulnerabilities, misconfigurations, and outdated services.

Each scan automatically updates your attack surface and provides an up-to-date map for planning targeted attacks or strategic lateral movements.

Explore a sample report, which includes a vulnerability summary, automatically confirmed findings, evidence, and more.

In a transparent benchmark, our tool outperformed the 6 most popular network scanners on the market, both open-source and commercial.