Summary
CVE-2026-111497, nicknamed HTTP2Shell (also Node2Shell and Broccoli2Shell), is an out-of-bounds write in the Brotli decoder affecting versions 1.0.3 through 1.2.0. This update covers two new developments on October 26: PHP's second Windows security rebuild in five days, and expert commentary cautioning that the emergency response outpaces observed exploitation. See our earlier coverage for the original Node.js disclosure and the .NET patches.
PHP Windows Rebuild
PHP rebuilt its official Windows packages to bundle Brotli 1.2.1:
| PHP line | Fixed Windows build |
|---|---|
| 8.5 | 8.5.12-1 |
| 8.4 | 8.4.27-1 |
| 8.3 | 8.3.36-1 |
| 8.2 | 8.2.35-1 |
The -1 suffix marks a dependency rebuild; PHP source versions are unchanged. The previous week's Windows releases bundled the vulnerable Brotli 1.2.0.
Attack path: PHP's cURL extension on Windows can invoke the decoder when automatic response decompression is enabled. cURL leaves this off by default, but applications and HTTP client libraries may set CURLOPT_ENCODING. PHP offers no formal workaround, though not setting that option avoids the path. The separate PHP brotli extension is fixed in 0.21.1.
Severity and Exploitation
- Google rates the flaw Critical (CVSS 4.0: 9.2); Red Hat rates it 8.1 (Important) on CVSS 3.1; Node.js rates it High.
- CISA's October 23 assessment recorded no exploitation and the CVE was not in the KEV catalog at that time.
- Code execution has been demonstrated publicly on Node.js 24.22.0, but no attacks in the wild have been observed, which is the basis for expert calls to keep the response proportionate.
Recommended Actions
- Update Node.js to 22.23.4, 24.22.1 or 26.12.1; other fixed builds include Bun 1.4.4 and Python Brotli 1.2.1.
- Update PHP on Windows to the rebuilt packages above.
- Prioritize services that decompress Brotli data from untrusted sources.
- Where no fix exists yet, disable Brotli decoding. End-of-life Node.js lines (25.x, 23.x, 20.x and earlier) receive no fix.