A newly mapped vulnerability dubbed HTTP2Shell—officially CVE-2026-111497—extends far beyond Node.js, putting a wide range of systems at risk. Research reveals that the flaw in Google’s Brotli decoder affects .NET applications, FFmpeg libraries, ClickHouse servers, and Apache Arrow workloads, potentially exposing them to memory corruption, crashes, or denial of service scenarios. Details released by security firm JFrog make clear that simply updating Node.js won’t cover every affected environment.
What the flaw is and where it hides
The underlying issue lies inside the Brotli decoder code, not in the HTTP/2 protocol itself. A malformed “invalid block switch” inside certain Brotli streams can trigger a broken state in the decoder, which in turn may lead to buffer overflows—that is, operations that write past the intended memory region. Builds with Brotli versions 1.0.3 through versions just prior to 1.0.10, 1.1.0 up to before 1.1.1, and 1.2.0 before 1.2.1 are vulnerable.
In Node.js, patches have been issued in recent versions—22.23.4, 24.22.1, and 26.12.1—that include fixes for this Brotli issue, but many other tools, frameworks, and applications also depend on the same Brotli decoder library. Their security depends on whether maintainers have issued updated builds or library packages rather than purely checking version numbers.
How major platforms are impacted
• FFmpeg – A crafted JPEG XL image embedding malformed Brotli data inside compressed metadata triggers memory corruption during cleanup when processed by FFmpeg’s libjxl. While this stops short of confirmed remote code execution, it demonstrates how media files pose a real risk.
• .NET – A two-stage stream can corrupt Brotli’s internal state during decompression API usage, causing segmentation faults. Though the test was local, vulnerable paths exist in server-side components like ASP.NET Core and in HttpClient response handling.
• ClickHouse – The server crashes when a single request with a 23MB Brotli-compressed payload is sent. Decoder corruption forces process failure, halting active queries. A patch has been merged, but no release was available at the time data was published.
• Apache Arrow – In Arrow’s pyarrow component, an input of just 534 bytes entered via Brotli decoding triggers an endless loop that monopolizes CPU and blocks completion. The newer Brotli 1.2.1 version rejects the same input quickly. Arrow maintainers had not closed the issue as of publication.
Security teams are urged to treat untrusted files, HTTP requests, or other external inputs feeding into Brotli decompression as risky. Tools exist, like JFrog’s scanner, to trace potential exposure—but scanning alone does not always translate into proof of exploitability.
Microsoft responded on October 25 by pushing out fixes for supported .NET runtimes and SDKs. Other platforms and libraries may need to coordinate updates to integrate patched Brotli versions or corresponding builds.
This vulnerability underscores the hazards that come when widely shared libraries propagate a flaw across diverse stacks. HTTP2Shell is a textbook case of how a single decoder issue can ripple through multiple ecosystems—from media processors to database engines to web frameworks—creating a broad attack surface. What to watch: full patch rollouts across all affected components, increased scrutiny of Brotli usage in new and legacy systems, and whether attacker proofs emerge showing remote code execution. Ensuring that decompression paths are correctly validated will be essential to closing this gap in the security chain.
