- Home
- HTTP2Shell check
Is your website exposed to HTTP2Shell?
A critical flaw in the Brotli decoder (CVE-2026-111497, CVSS 9.2), nicknamed HTTP2Shell or Node2Shell, lets an attacker crash a server, or even run code on it, with crafted compressed data. Enter your website: we spot the technology it discloses and, when its version is visible, compare it with the fixed releases.
Passive check: a single visit of the home page, like a browser. No crafted data is sent.
Brotli often hides in the dependencies
This check only sees the technology disclosed by the home page. Our audits look for vulnerable copies where they really are and tell you what to fix, in order.
Code analysis
Finds the vulnerable dependencies of your application (npm and Python packages, Go modules), without uploading the code.
1 to 3 KreditsNon-destructive penetration test
Identifies the real technology even when it is hidden, then tests the known flaws of your site.
5 KreditsSurface and SSL/TLS audit
Certificate, protocols, headers and exposed public information, with a grade from A+ to F.
FreeHTTP2Shell in short
HTTP2Shell (CVE-2026-111497) is an out-of-bounds write in the C decoder of Brotli, Google’s compression library, versions 1.0.3 to 1.2.0. Despite its name, the HTTP/2 protocol is not at fault. It also goes by Node2Shell, Python2Shell and Broccoli2Shell.
A program has to decompress a Brotli stream supplied by someone else. Server side: a request body sent with Content-Encoding: br (Express 5 decodes it by default). Client side: a compressed response read by fetch() in Node.js, Bun, requests, aiohttp, httpx or curl. WOFF2 fonts, JPEG XL images and Parquet files go through Brotli too.
Depending on the application, the effect ranges from a crashed service to code execution without authentication. Node.js, Bun, Python, Go, Envoy, Istio and .NET have released fixes.
No remote test can prove the flaw without risking a server crash: this check only reads what the site discloses. The real check happens on the server, by listing the installed versions.
How to protect your site
- 1
List the installed versions
On every server and Docker image. Do not trust process.versions.brotli, which still shows 1.2.0 after the fix: only the Node.js version counts.
node -v bun --version pip show brotli brotlicffi dpkg -l 'libbrotli*' - 2
Update
Node.js 22.23.4, 24.22.1 or 26.12.1 (18, 20, 23 and 25 will get no fix), Bun 1.4.4 then rebuild the binaries, brotli 1.2.1 and brotlicffi 1.2.1.0 for Python, andybalholm/brotli v1.2.7 for Go, Envoy 1.36.12, 1.37.8, 1.38.6, 1.39.3 or 1.40.0, and your distribution’s libbrotli package.
- 3
Meanwhile: refuse incoming Brotli
Reject Brotli-compressed requests before they reach the application, and turn off automatic decompression of outgoing calls where possible. For fetch() in Node.js, only the update protects you.
if ($http_content_encoding ~* "br") { return 415; }
Frequently asked questions
Is the check really free?
Yes, no account and no limit other than a reasonable number of checks per quarter of an hour.
Can the check break my website?
No. We make a single visit of the home page and read the headers, like a browser. No crafted compressed data is sent.
Why can the check not be certain?
The only direct proof would be to send a crafted Brotli stream, which may crash the server. We stick to what the site discloses: the technology, and its version when visible.
My site runs PHP or WordPress, am I affected?
The site itself rarely, but the tools running next to it may be: Node.js scripts, Python bots, an Envoy proxy or libraries reading fonts or images. List the versions on the server.