The Brotli flaw is now being used in attacks. Here's the checklist
If you've been putting off the Brotli updates I've written about over the last week, now's the time to stop. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its list of vulnerabilities that attackers are actively using.
In all three of my earlier posts I said there was no sign of real attacks yet. That's no longer true.
What happened
On 27 October CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue. CISA only puts a flaw on that list when it has evidence that someone is exploiting it. The alert doesn't say who is behind the attacks or what they've targeted, and I'm not going to guess.
CISA's entry describes a flaw that lets "a remote unauthenticated attacker" corrupt memory, leak data, crash the program or possibly run their own code, all by sending a crafted Brotli stream. US federal agencies have until 10 November to deal with it. That deadline doesn't apply to you or me, but it gives you an idea of how seriously CISA takes it.
BleepingComputer's report notes that the flaw goes by several nicknames, including Node2Shell and HTTP2Shell. If you've seen those in the news, it's all the same bug.
Does it affect you?
Brotli is a compression library, and the bug is in the code that unpacks it. That's why it has turned up in so many places. So far I've covered Node.js, Python and the system library curl uses, and .NET.
The risk is software that unpacks Brotli data it got from somewhere else. Imperva, which showed code execution against an unpatched Node.js, notes that "a bare Node.js HTTP server" doesn't unpack incoming Brotli just by receiving it. Its examples of risky setups include some Express 5 and body-parser 2 releases when they unpack request bodies, and Node's own fetch() reading compressed responses.
So not every server is exposed. But working out exactly which apps unpack what takes longer than just updating, which is why I'd update everything.
The one bit of good news
When I wrote the Node.js and Python posts, Ubuntu still listed every release as "Needs evaluation". That's changed. Ubuntu's CVE page now shows a fixed Brotli package for every supported release:
- 26.04 LTS: 1.2.0-3ubuntu0.1
- 24.04 LTS: 1.1.0-2ubuntu0.1
- 22.04 LTS: 1.0.9-2ubuntu0.1
- 20.04 LTS and older: fixed, but only through Ubuntu Pro
One catch for anyone still on Ubuntu 20.04. Ubuntu lists its own Node.js package there as "Vulnerable", because that version carries its own copy of Brotli rather than using the system one. On 22.04 and later, Ubuntu's Node uses the system library, so the Brotli update covers it.
What to do this week
1. Install your system updates. On Debian or Ubuntu:
sudo apt update && sudo apt upgradeThen check the Brotli package version against the list above:
apt-cache policy libbrotli12. Restart anything that still has the old library loaded. A running program keeps the old code in memory. This lists the process IDs that have Brotli loaded:
sudo grep -l libbrotli /proc/*/mapsRestart those services, or reboot the server if that's simpler.
3. Check every Node.js install. Run node -v and look for 22.23.4, 24.22.1, 26.12.1 or later. Remember the copies installed with nvm, downloaded by hand or running inside Docker, because system updates don't touch any of those.
4. Check your Python apps. In each virtual environment, pip show brotli brotlicffi should show 1.2.1 or later.
5. Check .NET. dotnet --list-runtimes should show 8.0.33, 9.0.22, 10.0.14 or later. Self-contained apps need rebuilding.
6. Rebuild your containers. I keep saying this because it's the step people miss. A container has its own copy of everything, however up to date the server underneath it is. Rebuild your own images and pull fresh ones for other people's tools.
7. Look for odd crashes. Imperva suggests treating unexpected process exits and decoder errors as "leads to investigate". They aren't proof of an attack, but if an app has been falling over for no obvious reason since the flaw went public on 21 October, it's worth a closer look.
The bigger point
This is how it usually goes. The fix comes out, there's a week or so of "no known attacks", and then the attacks start. If you patched last week, you're already done. If you were waiting to see whether it was worth the bother, this is your answer.
The hard part isn't the updates. It's knowing every place the library lives: the system package, Node, Python, .NET and every container. If you're not sure what's on your servers, that's exactly what my server health check is for.
Liked that? Get the next one by email
When a security flaw lands that could affect your server, I'll email you what it means and what to do. Plus the odd opinion piece. Not often, no spam.