#3889 Add @swamp/cve/http2shell: scan and mitigate the Brotli decoder RCE (CVE-2026-111497, Node2Shell/HTTP2Shell)

Problem

CVE-2026-111497 (CVSS 4.0 9.2, disclosed 2026-10-21) is an out-of-bounds write in Google's C Brotli decoder, versions 1.0.3 through 1.2.0. A crafted stream forces an impossible block switch that the decoder reports as "needs more input", so it keeps writing into an 8-byte internal buffer: crash, memory disclosure, or code execution (Imperva reached RCE on stock Node 24.22.0, not reliably). No exploitation in the wild reported as of 2026-10-22.

The attack is remote and unauthenticated, in both directions:

• inbound: Content-Encoding: br request bodies (Express 5.0–5.3, body-parser 2.0–2.3, Envoy/Istio)
• outbound: malicious Brotli responses decoded by Node fetch(), or by urllib3/requests, aiohttp, httpx[brotli] and Scrapy whenever the Python Brotli or brotlicffi package is installed. Application code never has to import Brotli.

pip-audit, Dependabot and Safety did not flag the affected PyPI versions as of 2026-10-23, so users have no reliable scanner today.

Fixed versions

• Brotli 1.2.1 / 1.1.1 / 1.0.10 (upstream commit 0ed4268)
• Node.js 22.23.4, 24.22.1, 26.12.1 (20, 23, 25 are EOL, no fix)
• Bun 1.4.4
• Python Brotli 1.2.1, brotlicffi 1.2.1.0 (GHSA-9v8h-qqgm-4m35)
• Envoy 1.37.8 / 1.38.6 / 1.39.3 / 1.40.0; Istio 1.29.9 / 1.30.6 / 1.31.2
• Ruby brotli gem 0.9.1
• Debian 12 brotli 1.0.9-2+deb12u1, Debian 13 1.1.0-2+deb13u1; sid/forky and Amazon Linux 2023 still pending
• No fix yet: .NET runtime (bundles 1.1.0), PHP brotli ext, DuckDB, ClickHouse, Arrow, p7zip, MuPDF

Proposed extension

New @swamp/cve/http2shell under cve/, same shape as php-rce-2026-10 and emudhra: scan (local, SSH, Docker container or image), scanFleet (SSH, parallel), mitigate (dryRun defaults to true), plus a report.

Platforms: linux, darwin, windows (x86_64 and aarch64 where applicable).

scan inventories every Brotli decoder

• system libbrotli (dpkg/rpm/apk/brew) against distro tracker data; anything else below upstream fix is check-vendor
• Node.js (PATH, nvm/fnm/volta/scoop/choco). Distro Node links the system libbrotli, so its verdict follows that package; upstream builds bundle their own
• Bun
• Python Brotli/brotlicffi read from dist-info in site-packages and venvs, flagged when an auto-decoding client sits beside it
• .NET runtimes (no-fix-released)
• Envoy / Istio proxies
• curl and whether it links Brotli
• Electron apps (check-vendor)
• lockfiles under searchPaths: poetry.lock, uv.lock, requirements*.txt, Pipfile.lock, package-lock.json, Gemfile.lock
• running processes still mapping an old libbrotlidec or running an old binary: restart-required

Reported as not affected: Rust brotli-decompressor, Java/JS/C# ports, Deno (and so swamp; to confirm), Go andybalholm/brotli (crash only, fixed 2026-10-23).

Verdicts: patched, vulnerable, unsupported, update-available, check-vendor, restart-required, not-affected, unknown. Each finding also carries an exposure flag (auto-decoding client, inbound decoding middleware, listening service).

Windows reuses the PowerShell probe and Windows-OpenSSH handling from php-rce-2026-10 and emudhra; versions come from version resources and package metadata, never by running the runtime.

mitigate

• Linux: upgrade the distro brotli and nodejs packages via the package manager (sudo -n, checked per command), then restart processes still mapping the old library
• Python environments: report the pin change; opt-in flag runs pip install -U "Brotli>=1.2.1" per environment found
• upstream Node, Bun, Envoy, .NET: report only
• containers: rebuild-image with the base or pin change, never modified
• Windows and macOS: scan only; saves a script (.ps1 / .sh) with the exact upgrade commands
• opt-in stopgaps: uninstall Python Brotli packages (clients fall back to gzip/deflate), and emit proxy rules rejecting Content-Encoding: br. Stripping br from Accept-Encoding alone is noted as insufficient.

Out of scope for v1

No live probe. No safe test vector is published, and feeding a crafted stream to a vulnerable decoder triggers the write itself. Detection is by version and linkage only.

References

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
• https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497
• https://broccoli2shell.com/
• https://security-tracker.debian.org/tracker/CVE-2026-111497
• https://explore.alas.aws.amazon.com/CVE-2026-111497.html
• https://www.imperva.com/blog/node2shell-from-brotli-data-to-remote-code-execution/