The Real Culprit Was Google's Compression Technology...Node.js Hole Spreads Across Web as 'HTTP2Shell'

It has been confirmed that the real root cause of the Node.js security patch that mobilized server administrators worldwide last week was Google's data compression technology 'Brotli'. As the same flaw spread to Python, Envoy (web communication relay software), and Deno (a JavaScript runtime environment), the security industry has given this incident a new name: 'HTTP2Shell'. A single hole in one compression component has spread across the entire web.

Brotli is a compression technology that reduces the size of web pages and data for faster transmission, and is embedded as a component in numerous software programs. The flaw in question (CVE-2026-111497, severity 9.2) fails to filter manipulated data during the decompression process, causing writes to occur outside the permitted memory range. This can lead to server crashes, information leakage, and in certain conditions, remote code execution.

The spread occurred over the course of four days. On the 21st, Node.js released a patch and the vulnerability was called 'Node2Shell', but on the 22nd it was also found in Python's Brotli library, and on the 23rd, security firm Aikido Security identified it as a broader problem affecting HTTP communication software, renaming it to 'HTTP2Shell'. The affected scope includes the original Brotli library (patch 1.2.1) and Node.js (22.23.4·24.22.1·26.12.1), Python Brotli·brotlicffi (1.2.1), Deno (1.4.4), and Envoy (1.40.0, etc.). Developers who do not directly use Brotli can also be affected through software that embeds this component. However, the default configurations of nginx and Apache web servers are outside the affected scope.

More painfully, this hole had already been discovered eight months ago. OpenAI's security team (Codex Security) found the flaw in February and reported it to Google, and Google fixed the source code on February 27th. However, it was not recognized as a security flaw, so the patch was never released as an official release. Over the subsequent eight months, there were no new releases of Brotli, and copies embedded in software worldwide continued to run in a vulnerable state despite the fixed code being available. The distinction between fixing and distributing revealed a structural vulnerability in the open-source supply chain.

Fortunately, actual attacks have not been observed yet. As of the 24th, there have been no reports of real-world exploitation, and it has not been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA)'s list of exploited vulnerabilities. It is still at the stage of proof-of-concept demonstrations in security companies' laboratories. In this regard, it differs from last week's 'PHP2Shell'. PHP2Shell, a vulnerability in the PHP engine itself, is a separate incident where actual attack attempts were detected before public disclosure. The common points between the two incidents are that they occurred in the same week and the naming convention of 'X2Shell'.

There is a gap in the domestic response. The Korea Internet & Security Agency (KISA) issued a Node.js update recommendation on the 23rd, but as of the 25th, no separate notice had been issued for the original Brotli library and other affected software such as Python and Envoy. Rather than waiting for an official notice, operators should directly check their list of used software for the presence and version of Brotli.

PHP, Node.js, and its underlying Brotli—all within one week. The lesson left by this 'security week' is clear. The web stands on a few common components, and a single hole in one component and one missed deployment can shake the entire system. Patches came quickly, but the next hole may well be sleeping in another component for eight months to come.