Brotli vulnerability checker

Check whether your software is affected by CVE-2026-111497, the Brotli decoder flaw also called Node2Shell, HTTP2Shell and Broccoli2Shell. Look up a version, run the read-only self-check script, or check a domain for hints. Nothing you enter is stored.

1. Look up a version

Find it with node -v

Pick the software, enter its version, and the result appears here.

2. Run the self-check script on your servers

The strongest check is one that runs where your software is installed. These scripts read the versions of Node.js, Bun, .NET, PowerShell, Envoy, the Python Brotli packages, the system Brotli library and, on Windows, PHP. They compare them with the fixed releases and print the result. They are read-only, send nothing anywhere and need no admin rights. Read them before you run them.

Linux and macOS

View the script
curl -fsSL https://ex.truvocyber.com/brotli-check.sh -o brotli-check.sh && less brotli-check.sh && sh brotli-check.sh

Windows (PowerShell)

View the script
iwr https://ex.truvocyber.com/brotli-check.ps1 -OutFile brotli-check.ps1; notepad brotli-check.ps1; powershell -ExecutionPolicy Bypass -File .\brotli-check.ps1

The script sees what is on the PATH of the user who runs it. Run it inside each container image too, and rebuild self-contained .NET apps and bun build --compile executables, which carry their own copy of the decoder. Exit code 1 means something needs attention, so the script can run in CI.

3. Check a domain for hints

Limits of the domain check

The domain check reads the response headers a site chooses to send. It can hint at the software behind the site, but it cannot see versions or whether the site decompresses Brotli at all.

  • It sends no Brotli data and does not test for the flaw.
  • Node.js, .NET and Envoy rarely show a version in headers, so the result is a hint, never a verdict.
  • A site is exposed only if some part of it decompresses Brotli it did not create, such as request bodies or responses fetched from elsewhere. Serving Brotli to browsers is not the risk.
  • Use the version lookup or the self-check script for a real answer.

Enter a domain, and any hints appear here.

What to do next

Read the Brotli incident tracker for the timeline, vendor fixes and response steps, or see every check Truvo Exposure runs.

What you need to know

What the flaw is

CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, fixed in Brotli 1.0.10, 1.1.1 and 1.2.1 on October 21, 2026. Node.js, .NET, Bun, Python packages, Envoy and PHP's Windows builds bundle the decoder. The press calls it Node2Shell, HTTP2Shell and Broccoli2Shell.

Who is exposed

Software that decompresses Brotli it did not create: request bodies sent with Content-Encoding: br, responses fetched from other servers, or uploaded files. A site that only serves Brotli to browsers is not exposed by that alone.

How bad it is

Crafted Brotli data can corrupt memory in the program that decompresses it and may let an attacker run code. Google rates it 9.2 Critical and Microsoft 8.1 High. No attacks had been reported as of October 27, 2026.

Why there are three ways to check

The version lookup is exact for the version you enter. The self-check script reads every version installed on a machine. The domain check only hints at the software behind a site, because most stacks do not show their version.