Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Brotli is a lossless compression algorithm and data format developed by Google. It’s a way to make data smaller for storage or sending over the internet. Software then unpacks it to recover the original data. It’s widely used for HTTP compression to compress web content such as HTML, CSS, and JavaScript.

Brotli 是由 Google 开发的一种无损压缩算法和数据格式。它是一种用于减小数据体积以便存储或通过互联网传输的方法。软件随后会对数据进行解压以恢复原始数据。它被广泛用于 HTTP 压缩，以压缩 HTML、CSS 和 JavaScript 等网页内容。

CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder affecting versions 1.0.3 through 1.2.0 on all platforms. This is the same Brotli decoder flaw behind Node2Shell announced a couple days ago. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, leak sensitive data, crash the process, or potentially execute arbitrary code. It carries a CVSS v4.0 score of 9.2 (Critical), and Node.js is affected through its bundled Brotli library.

CVE-2026-111497 是 Google Brotli 解码器中的一个越界写入漏洞，影响所有平台上的 1.0.3 至 1.2.0 版本。这与几天前宣布的 Node2Shell 背后的 Brotli 解码器缺陷是同一个。远程、未经身份验证的攻击者可以发送精心构造的 Brotli 压缩流来破坏内存、泄露敏感数据、导致进程崩溃或潜在地执行任意代码。该漏洞的 CVSS v4.0 评分为 9.2（严重），Node.js 因捆绑了 Brotli 库而受到影响。

A bug makes the Brotli decoder keep accepting more bytes when it should reject the data. Those bytes can overflow a small working buffer and damage the program’s memory. An attacker can use that damage to control what runs, such as their own code.

一个错误导致 Brotli 解码器在应该拒绝数据时却继续接收更多字节。这些字节可能会溢出小型工作缓冲区并损坏程序的内存。攻击者可以利用这种损坏来控制运行的内容，例如运行他们自己的代码。

OpenAI found this in February reported it as unauthenticated remote code execution that works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses.

OpenAI 在二月份发现了此漏洞，并将其报告为一种双向工作的未经身份验证的远程代码执行漏洞，因此恶意客户端可以接管未打补丁的服务器，而恶意服务器也可以接管接受压缩响应的未打补丁的客户端。

The root cause was fixed in the Brotli source code in February, but it wasn’t recognized as a security issue at the time and no release shipped with the fix until now. That means every project that bundles Brotli has to ship its own update.

根本原因在二月份已于 Brotli 源代码中修复，但当时并未被识别为安全问题，直到现在才发布包含修复程序的版本。这意味着每个捆绑 Brotli 的项目都必须发布自己的更新。

You’re exposed if any environment has Brotli 1.2.0 or earlier or brotlicffi 1.2.0.x installed, since HTTP clients such as requests, httpx, and aiohttp load these packages automatically when they’re present. Upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild any container images that bundle them. As of October 23, advisory databases don’t map the CVE to either PyPI package, so pip-audit, Dependabot, and Safety won’t flag vulnerable versions yet.

如果任何环境中安装了 Brotli 1.2.0 或更早版本，或者 brotlicffi 1.2.0.x，您就会面临风险，因为 requests、httpx 和 aiohttp 等 HTTP 客户端在这些包存在时会自动加载它们。请升级到 Brotli 1.2.1 或 brotlicffi 1.2.1.0，并重新构建任何捆绑了这些包的容器镜像。截至 10 月 23 日，咨询数据库尚未将此 CVE 映射到任何一个 PyPI 包，因此 pip-audit、Dependabot 和 Safety 尚不会标记这些易受攻击的版本。

You can see what we’ve tracked here in Aikido Intel.

您可以在 Aikido Intel 中查看我们跟踪的内容。

As for unaffected software, Apache’s standard mod_brotli does not decode Brotli

至于不受影响的软件，Apache 标准的 mod_brotli 不会解码 Brotli。

For CVE-2026-111497, update the affected runtime or Brotli library:

对于 CVE-2026-111497，请更新受影响的运行时或 Brotli 库：

Update dependency locks, rebuild affected applications and container images, redeploy, and restart services. Verify that running workloads use the patched components.

更新依赖锁定，重新构建受影响的应用程序和容器镜像，重新部署并重启服务。验证正在运行的工作负载是否使用了已修补的组件。

These workarounds reduce exposure while you prepare the upgrade:

这些变通方法可以在您准备升级时降低风险：

Changing Accept-Encoding alone is insufficient: a malicious server can send a Brotli response regardless of what the client advertises, and urllib3 selects its decoder from the response’s Content-Encoding header.

仅更改 Accept-Encoding 是不够的：无论客户端声明什么，恶意服务器都可以发送 Brotli 响应，而 urllib3 会根据响应的 Content-Encoding 标头选择其解码器。

Keep these controls in place until affected components are patched and verified. Review coverage as vendors confirm additional affected components or attack paths.

在受影响的组件得到修补和验证之前，请保持这些控制措施。随着供应商确认更多受影响的组件或攻击路径，请审查覆盖范围。

Aikido flags vulnerable versions of Brotli and brotlicffi in your repositories, container images, and dependencies, including when they arrive as transitive dependencies. Your dashboard shows which services still run a vulnerable version, so you can upgrade the ones that call outside servers or accept compressed request bodies first.

Aikido 会标记您存储库、容器镜像和依赖项中易受攻击的 Brotli 和 brotlicffi 版本，包括它们作为传递依赖项出现的情况。您的仪表板会显示哪些服务仍在运行易受攻击的版本，因此您可以优先升级那些调用外部服务器或接受压缩请求主体的服务。

Once you’ve upgraded, Aikido checks if the finding is gone.

一旦您完成升级，Aikido 会检查该漏洞是否已消除。

Brotli is a widely used compression library from Google. On Wednesday, October 22nd NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. Users were exposed if their app or a library decompresses bad Brotli data (e.g. the built-in fetch(), body-parser).

Brotli 是 Google 开发的一种广泛使用的压缩库。10 月 22 日星期三，NodeJS 披露了 CVE-2026-111497，被称为“node2shell”，其中解压攻击者控制的 Brotli 数据的 Node.js 进程可能会被诱导泄露内存或运行任意代码。如果用户的应用程序或库解压了恶意的 Brotli 数据（例如内置的 fetch()、body-parser），用户就会面临风险。

The next day, Python released a security update that patches the same flaw; Python packages were also vulnerable to CVE-2026-111497. Brotli flaw may affect even more languages and service applications, given how widely integrated the library is downstream. It turns out OpenAI had found this back in February.

第二天，Python 发布了一个安全更新来修补同样的缺陷；Python 包也容易受到 CVE-2026-111497 的影响。鉴于该库在下游的集成程度之高，Brotli 缺陷可能会影响更多的语言和服务应用程序。事实证明，OpenAI 早在二月份就发现了这一点。

The flaw sits in DecodeBlockTypeAndLength(), which handles block switches, the points where a Brotli stream changes which Huffman tree it uses. In vulnerable versions the function returns a plain boolean, and BROTLI_FALSE can mean either “this stream is malformed” or “I need more input.” Callers can’t tell the two apart, and on the fast path the decoder discards the return value entirely.

该缺陷位于 DecodeBlockTypeAndLength() 中，该函数处理块切换，即 Brotli 流更改其使用的霍夫曼树的点。在易受攻击的版本中，该函数返回一个简单的布尔值，而 BROTLI_FALSE 可能意味着“此流格式错误”或“我需要更多输入”。调用者无法区分这两者，并且在快速路径上，解码器完全丢弃了返回值。

A crafted stream can declare a single block type and then exhaust that block’s length, which forces a switch that can’t succeed. The decoder then either reports that it needs more input for a stream that’s complete, or keeps decoding with the block state it already had. That second path leads to the out-of-bounds write.

精心构造的流可以声明单个块类型，然后耗尽该块的长度，这会强制进行无法成功的切换。解码器要么报告它需要更多输入来处理一个完整的流，要么继续使用它已经拥有的块状态进行解码。第二种路径会导致越界写入。

The upstream fix, google/brotli commit 0ed4268, makes the function return an error code and adds a new error, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17). Decoding now stops on a format error on both the safe and fast paths. OSM diffed the Brotli 1.2.0 and 1.2.1 source distributions and found that 1.2.1 differs only in the version bump and the decoder changes from that commit.

上游修复（google/brotli 提交 0ed4268）使该函数返回错误代码，并添加了一个新错误 BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17)。现在，解码在安全路径和快速路径上遇到格式错误时都会停止。OSM 对比了 Brotli 1.2.0 和 1.2.1 的源代码分发，发现 1.2.1 仅在版本号提升和该提交带来的解码器更改方面有所不同。

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python. Two PyPI packages, Brotli and brotlicffi, compile the same vulnerable Brotli decoder that Node.js bundles. An official advisory was posted on GitHub. Brotli has 82.8 million downloads per month.

Node2Shell 背后的 Brotli 缺陷 (CVE-2026-111497) 影响 Python。两个 PyPI 包（Brotli 和 brotlicffi）编译了与 Node.js 捆绑的相同的易受攻击的 Brotli 解码器。GitHub 上发布了官方公告。Brotli 每月有 8280 万次下载。

You’re affected if any Python environment you run has Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x, installed. Popular HTTP clients such as requests and httpx load these packages automatically when they’re present. Some packages automatically install Brotli as a dependency such as Scrapy, while others require explicit mention of it. An attacker can reach the vulnerable decoder by sending a malicious Brotli response to a request your app makes, or by sending your app a request body compressed with Brotli. That means an app can be exposed without importing Brotli anywhere in its own code. It’s a popular transitive dependency, so check your systems.

如果您运行的任何 Python 环境中安装了 Brotli 1.2.0 或更早版本，或者 brotlicffi 1.2.0.x，您就会受到影响。流行的 HTTP 客户端（如 requests 和 httpx）在这些包存在时会自动加载它们。一些包（如 Scrapy）会自动将 Brotli 安装为依赖项，而其他包则需要明确提及它。攻击者可以通过向您的应用程序发出的请求发送恶意的 Brotli 响应，或者向您的应用程序发送用 Brotli 压缩的请求主体来触及易受攻击的解码器。这意味着应用程序即使在其代码中任何地方都没有导入 Brotli，也可能面临风险。它是一个流行的传递依赖项，因此请检查您的系统。

To fix it, upgrade to the patched releases:

要修复它，请升级到已修补的版本：

The re

重新