Lab #3889: Add @swamp/cve/http2shell: scan and mitigate the Brotli decoder RCE (CVE-2026-111497, Node2Shell/HTTP2Shell)

Problem

CVE-2026-111497 (CVSS 4.0 9.2, disclosed 2026-10-21) is an out-of-bounds write in Google's C Brotli decoder, versions 1.0.3 through 1.2.0. A crafted stream forces an impossible block switch that the decoder reports as "needs more input", so it keeps writing into an 8-byte internal buffer: crash, memory disclosure, or code execution (Imperva reached RCE on stock Node 24.22.0, not reliably). No exploitation in the wild reported as of 2026-10-22.

The attack is remote and unauthenticated, in both directions:

inbound: Content-Encoding: br request bodies (Express 5.0–5.3, body-parser 2.0–2.3, Envoy/Istio)
outbound: malicious Brotli responses decoded by Node fetch(), or by urllib3/requests, aiohttp, httpx[brotli] and Scrapy whenever the Python Brotli or brotlicffi package is installed. Application code never has to import Brotli.

pip-audit, Dependabot and Safety did not flag the affected PyPI versions as of 2026-10-23, so users have no reliable scanner today.

Fixed versions

Brotli 1.2.1 / 1.1.1 / 1.0.10 (upstream commit 0ed4268)
Node.js 22.23.4, 24.22.1, 26.12.1 (20, 23, 25 are EOL, no fix)
Bun 1.4.4
Python Brotli 1.2.1, brotlicffi 1.2.1.0 (GHSA-9v8h-qqgm-4m35)
Envoy 1.37.8 / 1.38.6 / 1.39.3 / 1.40.0; Istio 1.29.9 / 1.30.6 / 1.31.2
Ruby brotli gem 0.9.1
Debian 12 brotli 1.0.9-2+deb12u1, Debian 13 1.1.0-2+deb13u1; sid/forky and Amazon Linux 2023 still pending
No fix yet: .NET runtime (bundles 1.1.0), PHP brotli ext, DuckDB, ClickHouse, Arrow, p7zip, MuPDF

Proposed extension

New @swamp/cve/http2shell under cve/, same shape as php-rce-2026-10 and emudhra: scan (local, SSH, Docker container or image), scanFleet (SSH, parallel), mitigate (dryRun defaults to true), plus a report.

Platforms: linux, darwin, windows (x86_64 and aarch64 where applicable).

scan inventories every Brotli decoder

system libbrotli (dpkg/rpm/apk/brew) against distro tracker data; anything else below upstream fix is check-vendor
Node.js (PATH, nvm/fnm/volta/scoop/choco). Distro Node links the system libbrotli, so its verdict follows that package; upstream builds bundle their own
Bun
Python Brotli/brotlicffi read from dist-info in site-packages and venvs, flagged when an auto-decoding client sits beside it
.NET runtimes (no-fix-released)
Envoy / Istio proxies
curl and whether it links Brotli
Electron apps (check-vendor)
lockfiles under searchPaths: poetry.lock, uv.lock, requirements*.txt, Pipfile.lock, package-lock.json, Gemfile.lock
running processes still mapping an old libbrotlidec or running an old binary: restart-required

Reported as not affected: Rust brotli-decompressor, Java/JS/C# ports, Deno (and so swamp; to confirm), Go andybalholm/brotli (crash only, fixed 2026-10-23).

Verdicts: patched, vulnerable, unsupported, update-available, check-vendor, restart-required, not-affected, unknown. Each finding also carries an exposure flag (auto-decoding client, inbound decoding middleware, listening service).

Windows reuses the PowerShell probe and Windows-OpenSSH handling from php-rce-2026-10 and emudhra; versions come from version resources and package metadata, never by running the runtime.

mitigate

Linux: upgrade the distro brotli and nodejs packages via the package manager (sudo -n, checked per command), then restart processes still mapping the old library
Python environments: report the pin change; opt-in flag runs pip install -U "Brotli>=1.2.1" per environment found
upstream Node, Bun, Envoy, .NET: report only
containers: rebuild-image with the base or pin change, never modified
Windows and macOS: scan only; saves a script (.ps1 / .sh) with the exact upgrade commands
opt-in stopgaps: uninstall Python Brotli packages (clients fall back to gzip/deflate), and emit proxy rules rejecting Content-Encoding: br. Stripping br from Accept-Encoding alone is noted as insufficient.

Out of scope for v1

No live probe. No safe test vector is published, and feeding a crafted stream to a vulnerable decoder triggers the write itself. Detection is by version and linkage only.

Move the Zod argument-field extractor into @swamp-club/extension-scoring so the CLI and registry read schemas alike

Docs: extension quality scores with the registry formula and reports grade (swamp-club#3845)

serve: dispatch to an idle worker waits for its worker_busy write on the shared gateway transition tail

serve: worker enrollment resolves and creates the worker definition inside the serialized gateway transition tail

Datastore rework Phase 5 (team mode) 2/3: the CLI's serve upstream — with serverAddress, a v3 checkout commits, reads chunks and catches up through serve's datastore API, with no storage credentials

Extension dependencies: the shared import scan reads Babel syntax, not tokens (follow-up to #3969)

Rescore every extension's current version under rubric v5

Extension scoring queue: two replicas can claim the same pending event

Scheduled flaky-test detection is failing

Manual: the supported extension dependency categories, the canonical form and the lock rule, rewritten once against the final design

Registry audits v2 extension archives as written, and a range costs the loose point only without a valid lock

Extension consumers keep the publisher's bundle: pull, update and auto-resolve stop rebuilding (direction A for #3634)

Extension push: inputs that open up (workspace root lock, ancestor config refused by name, JSR dist-tags) and the skill docs rewritten once

Extension push ships the canonical form: every npm:/jsr: import pinned exact, and a v2 dependency-audit.json

stagecraft studio ticket columns: round-5 review lows from #3828 (source watch cost, relationText lookup, cross-instance claim)

A long-lived serve client for extensions, and a stable rate_limited error code

swamp serve on a v3 datastore never settles a workflow run left running by a stopped instance: boot reaper skips it as belonging to a remote instance

swamp serve on a v3 datastore: a run interrupted at a clean shutdown is never committed when the bucket is slow, and stays running for every other checkout

Support creating 1Password vaults for new clients

Filesystem datastore: an unclean shutdown leaves zero-byte data versions as the latest version, and `doctor datastores --repair` does not detect them

datastore_v3_replica_verify_test stall case flakes under the full integration run: restore.pid is read before the stub writes it

Generated state schemas require every child of nested objects, so normal resources warn on create/get

Add LinkedIn as a login provider

Showcase reward backfill can double-pay 5,000,000 points when replicas start together

Showcase editor: caption counter is not announced to screen readers

Profile showcase read: approved list sorts on review.reviewedAt in memory

Showcase countByStatus: $match live statuses before the $group

Showcase admin queues: index-serve the updatedAt sort on approved/rejected

Annotate and retain past workflow runs and data after the fact

Docs: --trusted-hosts accepts host:port for public addresses on non-default ports

A workflow step's method output is invisible to `data query` and `data list`, and the method summary's retrieval command returns an older run's data

Skill propulsion rule is silent when no transition is satisfied because stage work is outstanding

package.json mode: no loose-specifier warning for a range push ships as the exact installed version

extension fmt (and any command) creates or rewrites deno.lock when the extension lives in the repo's loaded extensions/ dir

serve shutdown does not wait for worker status writes, and its listener accepts workers after the gateway is disposed

stagecraft: rename work mode `method` to `behavior`, matching swamp's rename of models to behaviors

auth token create --json fields key and signinToken are undocumented; no token-mode service setup page

trigger.schedule is evaluated in the serve host's local time zone, with no zone field and no doc saying so

workflow validate/run say "Workflow not found" for a file that doctor workflows explains is misnamed

telemetry stats says "No telemetry data found" right after successful sends; say the spool is empty because it flushed

Docs: publish typed-secrets Phase 4.6 expression and delivery semantics

Extension registry page: a supported way to include media (images) in the README

CEL: data.latest(...).version is a double, but data.version() only accepts int, so "version - 1" fails at run time

workflow resume --run refuses workflows with the same step name in two jobs, though validate and run accept them

Update public OpenTelemetry manual for remote waterfalls and execution metrics (#3786)

Server-driven warning and info messages to CLI users, targeted by swamp version (exploration)

Serve: delegate namespace-scoped extension pulls and reload without granting administrator access

workflow cancel --server ignores --ca-cert and SWAMP_CA_CERT

Preserve active worker execution across serve restarts and upgrades; reconnect and reattach dispatches

v3: chunk durability barrier costs a full drive-cache flush per command on macOS; use an ordering barrier

vary/forEach object values with no key/name/id produce data names Windows refuses

issue-lifecycle start drops issue comments: context.comments is always empty

swamp core: a non-string sensitive value reads back as a JSON string

Generated vault keys carry raw data-name and vary characters that strict vault providers reject

bundleExtension 'bundles on different caches do not wait for each other' test fails under CPU load

Relationships

#3889 Add @swamp/cve/http2shell: scan and mitigate the Brotli decoder RCE (CVE-2026-111497, Node2Shell/HTTP2Shell)