True culprit was Google's compression technology…Node.js hole spreads across web as 'HTTP2Shell'

The true root of the Node.js security patch that set off alarm bells among global server administrators last week turned out to be Google's data compression technology, 'Brotli.' As the same flaw spread to Python, web communication relay software Envoy, and JavaScript runtime environment Bun, the security industry has given this incident a new name: 'HTTP2Shell.' A single hole in one compression component has spread across the entire web.

Brotli is a compression technology that reduces the file size of web pages and data for faster transmission, embedded as a component in numerous software programs. The flaw in question (CVE-2026-111497, severity 9.2) fails to filter manipulated data during decompression, causing writes beyond the allowed memory range, which can lead to server crashes, information leaks, and under certain conditions, remote code execution.

The spread pattern became clear in just four days. On the 21st, when Node.js released a patch for what was called 'Node2Shell,' the vulnerability was confirmed on the 22nd in Python's Brotli library, and on the 23rd, security firm Aikido Security confirmed it as a problem across HTTP communication software in general, renaming it 'HTTP2Shell.' The affected scope includes the original Brotli library (patched version 1.2.1) and Node.js (22.23.4, 24.22.1, 26.12.1), Python Brotli and brotlicffi (1.2.1), Bun (1.4.4), and Envoy (1.40.0, etc.). Developers who do not directly use Brotli can still be affected through software that embeds this component. However, default configurations of Nginx and Apache web servers are outside the affected scope.

What is particularly painful is that this hole was already discovered eight months ago. OpenAI's security team (Codex Security) found the flaw in February and reported it to Google, which fixed the source code on February 27th. However, it was not recognized as a security flaw, so the patched version was not released as an official release. Over the following eight months, there was not a single new release of Brotli, and copies embedded in software worldwide continued running vulnerable despite having fixed code available. It was fixing versus distributing—a structural loophole in the open-source supply chain laid bare.

Fortunately, actual attacks have not yet been observed. As of the 24th, there are no reports of real-world exploitation, and it has not appeared on the US Cybersecurity and Infrastructure Security Agency (CISA) list of exploited vulnerabilities. We are only at the stage of proof-of-concept demonstrations by security firms. In this regard, it differs from last week's 'PHP2Shell.' PHP2Shell, a vulnerability in the PHP engine itself, is a separate incident in which actual attack attempts were detected before public disclosure—the only commonalities between the two incidents are that they occurred in the same week and the naming convention of 'X2Shell.'

There is a gap in the domestic response. The Korea Internet & Security Agency (KISA) issued an update recommendation for Node.js on the 23rd, but separate notices regarding the original Brotli and other affected applications like Python and Envoy had not been released as of the 25th. Rather than waiting for official notices, system administrators should safely check their software inventory themselves to verify whether Brotli is embedded and which versions are in use.

Within one week: PHP, Node.js, and Brotli at its foundation. The lesson from this 'security week' is clear. The web stands on a handful of shared components, and a single hole in one component and one missed deployment can shake the entire system. Patches came quickly, but the next hole may be sleeping in some other component for eight more months.