# HTTP2Shell

**What is HTTP2Shell?**

HTTP2Shell is the nickname for CVE-2026-111497, a critical flaw in the Brotli compression library. Attackers can crash programs, read memory and sometimes run code without logging in.

Fixed versions: Brotli 1.0.10, 1.1.1, 1.2.1; Node.js 22.23.4, 24.22.1, 26.12.1.

## Related terms
- [PHP2Shell](https://vetosec.at/en/it-security/php2shell/)
- [Exploit](https://vetosec.at/en/it-security/exploit/)
- [Patch management and updates](https://vetosec.at/en/it-security/patch-management/)
- [CVE and CVSS](https://vetosec.at/en/it-security/cve-cvss/)

## Source
https://vetosec.at/en/it-security/http2shell/ (vetosec, angriffe)