> ## Documentation Index > Fetch the complete documentation index at: https://docs.threataware.com/llms.txt > Use this file to discover all available pages before exploring further. # HTTP2Shell: find affected devices > Find the servers and workstations your vulnerability scanner is missing, spot likely Node.js, Brotli and .NET installs, and track the fix for CVE-2026-111497, also known as Node2Shell Available on Each plan helps in a different way. See What ThreatAware can do on your plan, below. **HTTP2Shell** ([**CVE-2026-111497**](https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/)), also called Node2Shell and Broccoli2Shell, is a buffer overflow in Google's Brotli decoder library. An attacker who gets an application to decompress a crafted Brotli stream can crash it, expose memory and potentially run code on it. The stream can arrive in a compressed request sent to a server, or in a compressed response an application fetches. Despite the name, it isn't specific to HTTP/2. It was first found in Node.js, which bundles Brotli, and also affects Python HTTP clients with Brotli support, .NET and other software that uses a vulnerable Brotli decoder. **Your vulnerability scanner is the best way to find vulnerable software.** ThreatAware helps most by showing the servers and workstations that scanner isn't covering, where a vulnerable install could go unnoticed. | At a glance | | | - | - | | **Disclosed** | 22 October 2026. Brotli and Node.js fixes were released on 21 October | | **Severity** | Critical, as reported. Node.js rates it high | | **Affects** | Brotli 1.0.3 to 1.0.9, 1.1.0 and 1.2.0, and software that includes it: Node.js, Python HTTP clients with Brotli support, .NET, and Bun before 1.4.4 | | **Exploited** | Proofs of concept are public. No confirmed exploitation in the wild reported as of 26 October 2026 | | **Fix** | Update, restart the affected processes, and rebuild container images | ## Are you affected? | Product | Fixed in | | - | - | | Brotli library (Google) | 1.0.10, 1.1.1 or 1.2.1 | | Node.js 26.x (Current) | 26.12.1 | | Node.js 24.x (LTS) | 24.22.1 | | Node.js 22.x (LTS) | 22.23.4 | | Node.js 25.x, 23.x, 20.x and older | No fix. End of life, so treat as vulnerable and upgrade to a supported line. | | Python `brotli` package | 1.2.1 | | Python `brotlicffi` package | 1.2.1.0 | | Bun | 1.4.4 | | .NET | Microsoft's emergency update. Check Microsoft's advisory for the fixed version of yours. | **Updating the system Brotli library doesn't fix Node.js**, or any application that bundles its own copy. Update each one. Python HTTP clients are affected when they use a vulnerable Brotli decoder: `urllib3[brotli]`, `requests`, `httpx` and `aiohttp[speedups]`. Updating the `brotli` or `brotlicffi` package fixes them. An application is exposed when it decompresses Brotli data an attacker controls. The common cases: * **Servers** that decode request bodies sent with `Content-Encoding: br`, such as Express 5 and body-parser 2.x on Node.js. * **Outbound requests** whose client decompresses Brotli responses automatically, such as `fetch()` in Node.js and the Python clients above. Webhooks and features that call user-supplied URLs are the typical targets. * **Direct use** of a Brotli decoder on untrusted input. Then check your scanner for findings on CVE-2026-111497: * **A finding:** vulnerable. * **Recent credentialed scan, no finding:** likely fixed. * **No recent credentialed scan:** unknown. Treat it as vulnerable until it's scanned. A scan from before 21 October 2026 can't confirm the fix. ## What ThreatAware can do on your plan | Plan | What you can do | | - | - | | **Connect** | Find servers and workstations your vulnerability scanner doesn't know about. | | **Discover** | Also find scanner agents that have silently stopped working or are misconfigured. | | **Protect** | Also use software inventory to spot likely Node.js, Brotli and .NET installs, prioritise the ones with scanner gaps, and drive alerts and tickets. | ## Find affected devices ### 1. Find the gaps in your scanner's coverage This works exactly as for [PHP2Shell](https://docs.threataware.com/advisories/php2shell.md#1-find-the-gaps-in-your-scanners-coverage): use the integration columns in [Devices](https://docs.threataware.com/device-management.md) on Connect, and Vitals on Discover. For example, with Microsoft Defender as your scanner: | Find devices where the scanner is | Query | | - | - | | Not deployed | `system.microsoft_defender_atp.required:true AND system.microsoft_defender_atp.deployed:false` | | Deployed but not working | `system.microsoft_defender_atp.deployed:true AND system.microsoft_defender_atp.functioning:false` | | Misconfigured | `system.microsoft_defender_atp.functioning:true AND system.microsoft_defender_atp.configuredCorrectly:false` | Swap in your scanner: type `system.` in the query bar and autocomplete lists your integrations. ### 2. Spot likely installs with software inventory Available on Software Inventory is on Protect. > [!NOTE] > > **Treat it as a guide, not a vulnerability check.** A software query only matches where a connected tool lists the software as installed, so many installs never appear (see [Blind spots](#blind-spots)). Software data refreshes about every two days. The query bar is case sensitive, so the queries below check the common spellings with `OR`. Node.js, Brotli or .NET on a device with no working scanner is where a vulnerable install is most likely to go unnoticed: ```text theme={null} (software:{product:Node.js*} OR software:{product:nodejs*} OR software:{product:*brotli*} OR software:{product:*Brotli*} OR software:{product:Microsoft .NET*}) AND (system.microsoft_defender_atp.deployed:false OR system.microsoft_defender_atp.functioning:false) ``` To list Node.js installs that aren't on a fixed release: ```text theme={null} software:{product:Node.js*} AND NOT software:{product:Node.js* AND version:22.23.4*} AND NOT software:{product:Node.js* AND version:24.22.1*} AND NOT software:{product:Node.js* AND version:26.12.1*} ``` On Linux, run it again with `nodejs*` in place of `Node.js*`. If a later patch release comes out in the same line, add it to the query. To list Brotli library packages that aren't on a fixed release, such as `libbrotli1` on Linux: ```text theme={null} (software:{product:*brotli*} OR software:{product:*Brotli*}) AND NOT software:{product:*rotli* AND version:1.0.10*} AND NOT software:{product:*rotli* AND version:1.1.1*} AND NOT software:{product:*rotli* AND version:1.2.1*} ``` As with PHP, Linux distribution packages can carry a fix without changing the version number, so check your distribution's advisory before treating a version as vulnerable. For .NET, compare the versions you find against Microsoft's advisory. ## Track the fix Available on Tracked Views and Action Center are on Protect. 1. Run a query from step 1 or step 2 and click **Track View**. Choose **Snapshot** and set a **Deadline**. See [Tracked Views](https://docs.threataware.com/tracked-views.md). 2. In [Action Center](https://docs.threataware.com/automation.md), build a flow triggered by that tracked view to email the device owners or open tickets. 3. [Save the query as a view](https://docs.threataware.com/device-management.md#saving-a-view) and send a daily [Scheduled Report](https://docs.threataware.com/scheduled-reports.md) of it until it's empty. ## Blind spots Much of the vulnerable code lives where ThreatAware can't see installed software: | Where it runs | What to do | | - | - | | **Container images**, including images pinned to an old tag such as `node:22.23.3-alpine` | Rebuild and redeploy them. Check with `docker run --rm node --version`, or a connected container scanning tool. | | **Python environments**, including virtual environments and container images | Python packages rarely show up as installed software. Check the `brotli` and `brotlicffi` versions in each environment. | | **Applications that bundle their own Brotli** | Updating the system library doesn't fix them. Check each vendor's advisory. | | **CI runners and build agents** | Check `node --version` and Python package versions on each runner and in your pipeline images. | | **Managed platforms** that bundle their own Node.js | Check the provider's version. They can lag behind upstream. | | **Installs not registered with the OS**, such as version managers or zip extracts | Only visible if a vulnerability scanner detects them from files on disk. | If you can't update straight away, block incoming Brotli-compressed requests at your proxy or firewall, and remove Brotli support from Python applications. Blocking incoming requests doesn't protect against malicious compressed responses your applications fetch from other servers. > [!WARNING] > > **An empty list doesn't mean you're done.** Check the blind spots above, rebuild and redeploy container images, and restart every affected process after updating. A running process keeps the old code until it restarts. ## Sources * [BleepingComputer: Critical HTTP2Shell Brotli vulnerability triggers emergency patches](https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/) * [Aikido: Node2Shell, Node.js Brotli RCE (CVE-2026-111497)](https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497) * [Patchstack: Node.js out-of-bounds write in the bundled Brotli decoder](https://patchstack.com/database/npm/plugin/nodejs/vulnerability/node-js-22-23-4-24-22-1-26-12-1-out-of-bounds-write-in-the-bundled-brotli-decoder-leading-to-remote-code-execution) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.