Imagine a world where an attacker doesn't need your password, your API key, or even a valid account to take over your server. They just need to send a specially crafted HTTP request. That is the terrifying reality of the newly publicized "HTTP2Shell" vulnerability.

From Node2Shell to a Global Threat

What started as a specific flaw in Node.js—originally dubbed "Node2Shell" (CVE-2026-111497)—has evolved into a much broader crisis. At its core, the bug is an out-of-bounds write within the Brotli decompression engine. When a server attempts to decompress malicious Brotli-encoded data sent via a request body (specifically affecting Express 5 and body-parser 2.x), it can trigger a Remote Code Execution (RCE).

A Massive Blast Radius

While the initial focus was on Node.js, the threat has expanded. Security researchers now warn that Python and other environments using similar decompression libraries are also at risk. Because this happens during the decompression phase—often before any authentication checks occur—it is a "pre-auth" RCE. This means millions of web applications could be exposed if they are running unpatched versions of these languages.

How to Protect Your Stack

If you're running Node.js, the clock is ticking. Fixes have already been rolled out in versions 22.23.4, 24.22.1, and 26.12.1. The immediate priority for any dev team is to audit their runtime versions and update immediately. If you use Python or other languages that handle Brotli compression, keep a close eye on your package managers for emergency patches.

As we lean more on complex compression protocols to speed up the web, we're seeing that the very tools we use for efficiency can become the primary vectors for attack. Stay updated, or stay vulnerable.

Sources

• Node2Shell (CVE-2026-111497) - pwn.watch
• Evolving Threat: http2shell is an RCE in node, Python, and more - Zeli
• Node2Shell: Fixed Node.js Versions and Check - Brandefense