Brotli decoder RCE affects Node.js, Python
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Researchers demonstrated unauthenticated remote code execution in Google's Brotli decoder, affecting Node.js, Bun, Python and Envoy.
No in-the-wild attacks are confirmed, but HTTP Brotli decoders are in scope.
Background
Brotli is a compression library owned by Google; the flaw sits in its reference C decoder (versions 1.0.3 through 1.2.0), not in Node.js or Python themselves, so anything that ships or links the decoder may be affected. The fix existed in source code since February 2026 but was never released until exploitation potential was discovered, meaning vulnerable software shipped for eight months. Node.js shipped the fix first on October 21, 2026, and coverage initially treated it as a Node.js runtime bug; two days later researchers showed the PyPI packages Brotli and brotlicffi compile the same C decoder and that popular Python HTTP clients load them automatically. The threat was renamed HTTP2Shell once it was clear the bug lives in the shared library, putting any software that decodes Brotli over HTTP in scope.
How it unfolded
- Feb 2026The underlying Brotli fix existed in source code but was never released until exploitation potential was discovered, leaving vulnerable software shipped for eight months.
- Oct 21, 2026Node.js shipped the fix first at 10:38 UTC, addressing the flaw in versions 22.23.4, 24.22.1 and 26.12.1 as part of a security release that fixed ten vulnerabilities in total.
- Oct 23, 2026Researchers at OpenSourceMalware and Aikido showed the PyPI packages Brotli and brotlicffi compile the same C decoder and that popular Python HTTP clients load them automatically. CISA's assessment recorded exploitation as "none" and automation as "no".
- Oct 23, 2026The Go port (andybalholm/brotli) had the same logic error but would only have crashed; it was fixed. Aikido renamed the threat HTTP2Shell once it was clear the bug lives in the shared library, not one runtime.
- Oct 24, 2026Imperva's Red Team demonstrated unauthenticated RCE on an unpatched Node.js 24.22.0 build; researchers ran code on an official Node.js build in a lab, with no attacks in the wild confirmed yet.
Who’s saying what
- Official
- OpenAI's Codex Security team, which reported the flaw, says it enables unauthenticated remote code execution, so an unpatched server accepting compressed input could be taken over by a malicious client and an unpatched client by a malicious server.
- Caution
- Red Hat said there is no reliable public proof-of-concept for running code.
- Official
- CISA's October 23 assessment recorded exploitation as "none" and automation as "no".
- Analysts
- Node.js rates its own exposure as High, while Google's CVE record scores it 9.2 Critical on CVSS 4.0 and GitHub's advisory scores it 9.8 on CVSS 3.1.
Still unverified
No in-the-wild exploitation had been confirmed as of initial disclosure; CISA's October 23 assessment recorded exploitation as "none" and automation as "no", and the flaw is not in CISA KEV. Red Hat said there is no reliable public proof-of-concept for running code.