"HTTP2Shell" deb nomlangan Brotli'dagi — Node.js'ga o'rnatilgan C dekoder kutubxonasidagi — muhim zaiflik hujumchilarga xotirani buzish va maxfiy ma'lumotlarga kirish imkonini berishi mumkin.
Xavfsizlik muammosi CVE-2026-111497 sifatida kuzatilmoqda va shuningdek "Broccoli2Shell" hamda "Node2Shell" nomlari bilan ham tanilgan. U Brotli 1.0.3 dan 1.0.9 gacha, 1.1.0 va 1.2.0 versiyalariga ta'sir qiladi.
Zaiflik bir necha nom ostida e'lon qilingan, chunki u dastlab Node.js'da aniqlangan, keyin tadqiqotchilar Brotli dekoderidagi xuddi shu kamchilik bir nechta ekotizimlardagi dasturiy ta'minotga ta'sir qilishi mumkinligini aniqlagan.
Keng ta'sir
HTTP2Shell nomi uning HTTP mijozlari va serverlariga ta'sirini aks ettiradi, garchi zaiflik HTTP/2 ga xos emas va hujumchi nazoratidagi Brotli ma'lumotlarini dekompressiya qiladigan boshqa ilovalarga ham ta'sir qilishi mumkin.
Node.js'dan tashqari, potentsial ta'sirlangan dasturiy ta'minotga zaif Brotli dekoder bilan sozlangan Python HTTP mijozlari — masalan, urllib3[brotli], requests, httpx va aiohttp[speedups] — hamda zaif Brotli ilovalaridan foydalanadigan boshqa ilovalar va vositalar kiradi.
Yakshanba kuni Microsoft .NET'dagi muammoni hal qilish uchun shoshilinch xavfsizlik yangilanishini e'lon qildi va muvaffaqiyatli ekspluatatsiya zaif .NET versiyasiga ega tizimlarda imtiyozlarni oshirishga olib kelishi haqida ogohlantirdi.
Brotli — Google tomonidan yo'qotishsiz ma'lumot siqish uchun ishlab chiqilgan va saqlanadigan ochiq manbali loyihadir. U fayllarni tezroq uzatish uchun asl ma'lumotlarga ta'sir qilmasdan kichraytiradi.
Node2Shell zaifligi bufer to'lib ketishi (buffer overflow) bo'lib, maxsus tayyorlangan Brotli siqilgan oqim dekoder tomonidan haqiqiy deb qabul qilingan va ko'proq kirish so'rovi sifatida noto'g'ri talqin qilingan noto'g'ri blok almashinuvi (invalid block switch) ni keltirib chiqaradi.
Ichki sakkiz baytli buferga kirish baytlarini qo'shishda yozish uning chegaralaridan tashqariga chiqib, yaqin xotirani buzadi.
"Noto'g'ri blok almashinuvi doimiy format xatosi emas, balki vaqtinchalik ko'proq kirish ehtiyoji sifatida e'lon qilindi, shuning uchun oqimli dekoder kirish baytlarini sakkiz baytli ichki buferga qo'shishda davom etdi", — deb tushuntiradi Node.js o'z maslahatida.
Hujumchi ilovani zararli ma'lumotlarni dekompressiya qilishga majbur qilish orqali undan foydalanishi mumkin — masalan, URL'ni oladigan ilovaga siqilgan HTTP javobini yuborish yoki serverga siqilgan so'rovni to'g'ridan-to'g'ri yuborish orqali.
Node.js bu jarayonni ishdan chiqarishi, xotirani ochib qo'yishi va masofadan kod bajarish (RCE) imkonini berishi mumkinligini aytadi.
Kiberxavfsizlik kompaniyasi Imperva'ning yaqindagi hisobotida CVE-2026-111497 Node2Shell zaifligini ekspluatatsiya qilish RCE'ga olib kelishi tasdiqlangan.
Brotli'dagi yuqori oqim tuzatishlari loyihaning manba kodiga fevral oyida kiritilgan, ammo Node.js va Google foydalanuvchilar uchun barqaror tuzatishlarni 21-oktabrda e'lon qilgan, keyingi kuni esa ommaviy e'lon qilingan. Tuzatishlarni o'z ichiga olgan PyPI paketlari 23-oktabrda mavjud bo'lgan.
Tuzatilgan versiyalar:
- Google Brotli 1.0.10, 1.1.1, 1.2.1
- Node.js 22.23.4, 24.22.1, 26.12.1
- Python Brotli 1.2.1
- Python brotlicffi 1.2.1.0
Node2Shell uchun isbot-konsept (PoC) ekspluatatsiyalar e'lon qilingan, ammo yovuz ekspluatatsiya haqida hisobotlar yo'q. Shunga qaramay, foydalanuvchilar mavjud xavfsizlik yangilanishlarini tezda qo'llashlari kerak.
Yangilanishdan so'ng, ma'murlar ta'sirlangan jarayonlarni qayta ishga tushirishlari, ta'sirlangan konteyner tasvirlari esa qayta qurilishi va qayta joylashtirilishi kerak.
Kamchilikning ta'sirini kuzatuvchi maxsus onlayn portal tizim Brotli kutubxonasini yangilash Node.js joylashtirishlari yoki o'z ichiga o'rnatilgan kutubxona nusxasidan foydalanadigan boshqa ilovalardagi xavfni bartaraf etmasligi haqida ogohlantiradi.
Shuningdek, kiruvchi Brotli so'rovlarini bloklash hali ham zararli HTTP-javob yo'lini ochiq qoldiradi.
Agar darhol yangilash mumkin bo'lmasa, tavsiya Python ilovalaridan Brotli qo'llab-quvvatlashini olib tashlash va kiruvchi Brotli siqilgan so'rovlarni proksi yoki fayervol darajasida bloklashdir.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi.
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.
Blue Report 2026 himoyalarni texnika bo'yicha 338 million mijoz ishlab chiqarish muhitlarida o'tkazilgan simulyatsiyalar orqali o'lchaydi.
Hisobotni oling
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
The security issue is tracked as CVE-2026-111497 and is also known as “Broccoli2Shell” and “Node2Shell.” It affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.
The vulnerability has been reported under several names because it was initially identified in Node.js before researchers found that the same flaw in the Brotli decoder could affect software across multiple ecosystems.
Broad impact
The name HTTP2Shell reflects its impact on HTTP clients and servers, although the vulnerability is not specific to HTTP/2 and can affect other applications that decompress attacker-controlled Brotli data.
Apart from Node.js,potentially affected software includes Python HTTP clients such as urllib3[brotli], requests, httpx, and aiohttp[speedups], when configured with a vulnerable Brotli decoder, as well as other applications and tools that use vulnerable Brotli implementations.
On Sunday, Microsoft pushed an emergency security update to address the issue in .NET, warning that successful exploitation allows privilege escalation on systems with a vulnerable .NET version.
Brotli is an open-source project developed and maintained by Google for lossless data compression. It shrinks files so they can be transmitted faster without affecting the original data.
The Node2Shell vulnerability is a buffer overflow that lets a specially crafted Brotli-compressed stream trigger an invalid block switch that the decoder treats as valid and misinterprets as a request for more input.
By continuing to append input bytes to an internal eight-byte buffer, the writing extends beyond its bounds, corrupting nearby memory.
“An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer,” Node.js explains in an advisory.
An attacker can exploit it by getting an application to decompress malicious data, such as by serving a compressed HTTP response to an application fetching a URL, or by sending a compressed request directly to a server.
Node.js says that this can crash the process, expose memory, and enable remote code execution (RCE)
A recent report from cybersecurity company Imperva confirms that exploiting the CVE-2026-111497 Node2Shell vulnerability can lead to RCE.
The upstream Brotli fixes were first committed to the project’s source code in February, but Node.js and Google released stable fixes for users on October 21, followed by a public disclosure the next day. PyPI packages containing the fixes became available on October 23.
Patched versions are:
- Google Brotli 1.0.10, 1.1.1, 1.2.1
- Node.js 22.23.4, 24.22.1, 26.12.1
- Python Brotli 1.2.1
- Python brotlicffi 1.2.1.0
Proof-of-concept (PoC) exploits for Node2Shell have been published, but there are no reports of malicious exploitation in the wild. Nevertheless, users should prioritize applying the available security updates.
After updating, administrators must restart affected processes, and affected container images must be rebuilt and redeployed.
A dedicated online portal tracking the flaw's impactalso warns that updating the system Brotli library does not address the risk in Node.js deployments or other apps that use their own bundled copy of the library.
Also, blocking inbound Brotli requests still leaves the malicious HTTP-response route exposed.
If updating immediately is not possible, the recommendation is to remove Brotli support from Python applications and block incoming Brotli-compressed requests at their proxy or firewall level.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report