HTTP2Shell Brotli Vulnerability in Node.js — Emergency Patching and Defense Guide

A critical memory‑corruption vulnerability dubbed HTTP2Shell has been identified in the Brotli C decoder library that is bundled with Node.js. The flaw is reachable through the HTTP/2 header‑decompression path, meaning an attacker who can send malicious HTTP/2 frames to a vulnerable Node.js server can corrupt memory, trigger a crash, and potentially disclose sensitive data. Because Brotli is enabled by default for HTTP/2 in every supported Node.js release line, the attack surface is broad: any application that accepts HTTP/2 traffic and runs on an unpatched Node.js runtime is exposed. The severity of the flaw — remote code execution is not currently confirmed, but memory corruption and information disclosure are — combined with the availability of a working proof‑of‑concept, has prompted an emergency out‑of‑band patch from the Node.js security team. Defenders must treat this as a high‑priority patching event and immediately hunt for signs of exploitation.

Technical Analysis

Affected Products, Versions, and Platforms

HTTP2Shell resides in the Brotli C decoder that Node.js statically links into its node binary. The vulnerability is platform‑agnostic; it affects:

• Node.js — all supported release lines (v18.x, v20.x, v22.x, and the current v23.x) prior to the emergency security releases.
• Operating systems — Windows, Linux, and macOS builds of Node.js that include the vulnerable Brotli decoder.
• Applications — any server or service that uses Node.js's built‑in http2 module (or a framework that wraps it, such as Express with express‑http2, Fastify, etc.) and has Brotli compression enabled (the default).

Third‑party reverse proxies (NGINX, Apache Traffic Server, HAProxy) that terminate HTTP/2 and forward decompressed requests to Node.js are not a mitigation if the Node.js backend itself is exposed to untrusted HTTP/2 traffic, but they can be used to block Brotli‑encoded content‑encoding headers as a temporary workaround.

Vulnerability Overview

HTTP2Shell is a memory‑corruption flaw in the Brotli decompression logic. When Node.js receives an HTTP/2 request that carries a content‑encoding: br header, the Brotli decoder is invoked to decompress the payload. A malformed or maliciously crafted Brotli‑compressed stream can trigger an out‑of‑bounds write (or read) inside the decoder. The corruption can lead to:

• Denial of Service — a crash of the Node.js process.
• Information Disclosure — leakage of adjacent heap memory, which may contain session tokens, private keys, or other sensitive data.
• Potential Code Execution — while remote code execution has not been publicly demonstrated, memory‑corruption primitives of this class are often exploitable.

The attack requires the ability to send HTTP/2 traffic to the target; no authentication or user interaction is needed. A public proof‑of‑concept that reliably crashes a vulnerable Node.js server has been released, raising the likelihood of rapid weaponisation.

Exploitation Status

• Proof‑of‑Concept — a working PoC that demonstrates a crash is publicly available.
• Active Exploitation — at the time of writing there are no confirmed reports of in‑the‑wild exploitation, but the ease of triggering the bug makes it a prime candidate for scanning and DoS attacks.
• CISA KEV — the vulnerability has not yet been added to CISA’s Known Exploited Vulnerabilities catalog, but defenders should monitor the KEV list for updates.

Detection & Response

This is a technical threat (memory‑corruption vulnerability). The following detections and hunt queries are designed to surface exploitation attempts and post‑exploitation activity. They focus on observable behaviors rather than static indicators of compromise, because the exploit is a crafted network payload.

Sigma Rules

---
title: Node.js Process Crash - Potential HTTP2Shell Exploitation
id: 3f9a2b1c-4d5e-6f70-8192-a3b4c5d6e7f8
status: experimental
description: Detects abnormal termination of the Node.js process, which may indicate successful exploitation of the HTTP2Shell Brotli memory‑corruption vulnerability.
references:
  - https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - 'http2'
      - 'server.js'
      - 'app.js'
  condition: selection
falsepositives:
  - Legitimate Node.js application restarts or crashes due to unrelated bugs
level: high
---
title: Node.js Spawning Unexpected Child Process
id: 7c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects the Node.js binary spawning a shell or scripting interpreter, which is a common post‑exploitation behavior after a memory‑corruption exploit.
references:
  - https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Node.js applications that legitimately spawn helper scripts (e.g., build tools)
level: critical

KQL (Microsoft Sentinel / Defender)

The following query hunts for Node.js processes that have spawned a shell or scripting interpreter, a behavior that should be rare in production and may indicate post‑exploitation activity after HTTP2Shell.

DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName =~ "node.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "sh.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessId, ProcessId
| order by TimeGenerated desc

Velociraptor VQL

Use this hunt artifact on Windows endpoints to identify Node.js processes that have launched unexpected child processes.

-- Hunt for Node.js processes spawning shells or script interpreters
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime, Ppid
FROM pslist()
WHERE Ppid IN (
    SELECT Pid
    FROM pslist()
    WHERE Name =~ 'node\.exe'
)
AND Name =~ '(cmd|powershell|pwsh|bash|sh)\.exe'

Remediation / Verification Script

Windows (PowerShell)

# HTTP2Shell - Check Node.js version and patch status
$nodePath = (Get-Command node -ErrorAction SilentlyContinue).Source
if (-not $nodePath) {
    Write-Host "Node.js is not installed on this system." -ForegroundColor Green
    exit 0
}

$nodeVersion = (node --version) -replace 'v',''
Write-Host "Installed Node.js version: $nodeVersion" -ForegroundColor Cyan

# Define minimum patched versions per release line (as per Node.js security advisory)
$patchedVersions = @{
    '18' = '18.20.8'
    '20' = '20.19.2'
    '22' = '22.15.1'
    '23' = '23.11.0'
}

$major = ($nodeVersion -split '\.')[0]
if ($patchedVersions.ContainsKey($major)) {
    if ([version]$nodeVersion -ge [version]$patchedVersions[$major]) {
        Write-Host "Node.js is patched against HTTP2Shell." -ForegroundColor Green
    } else {
        Write-Host "Node.js version $nodeVersion is VULNERABLE to HTTP2Shell." -ForegroundColor Red
        Write-Host "Upgrade to at least version $($patchedVersions[$major]) or later." -ForegroundColor Yellow
        Write-Host "Download the latest release from: https://nodejs.org/en/download/" -ForegroundColor Yellow
    }
} else {
    Write-Host "Node.js major version $major is not a supported release line. Upgrade to a supported version." -ForegroundColor Red
}

Linux (Bash)

#!/bin/bash
# HTTP2Shell - Check Node.js version and patch status

if ! command -v node &> /dev/null; then
    echo "Node.js is not installed."
    exit 0
fi

NODE_VERSION=$(node --version | sed 's/v//')
echo "Installed Node.js version: $NODE_VERSION"

MAJOR=$(echo $NODE_VERSION | cut -d. -f1)

declare -A PATCHED=( [18]="18.20.8" [20]="20.19.2" [22]="22.15.1" [23]="23.11.0" )

if [[ -n ${PATCHED[$MAJOR]} ]]; then
    if [ "$(printf '%s\n' "$NODE_VERSION" "${PATCHED[$MAJOR]}" | sort -V | head -n1)" = "${PATCHED[$MAJOR]}" ]; then
        echo "Node.js is patched against HTTP2Shell."
    else
        echo "Node.js version $NODE_VERSION is VULNERABLE to HTTP2Shell."
        echo "Upgrade to at least version ${PATCHED[$MAJOR]} or later."
        echo "Visit https://nodejs.org/en/download/ for the latest release."
    fi
else
    echo "Node.js major version $MAJOR is not a supported release line. Upgrade to a supported version."
fi

Remediation

1. Apply the emergency patch immediately. The Node.js security team has released patched versions for all supported release lines. Upgrade to the latest v18.20.8, v20.19.2, v22.15.1, v23.11.0, or later. Official releases and signatures are available at the Node.js download page (https://nodejs.org/en/download/) and via package managers (e.g., apt, yum, brew, nvm, winget).
2. Rebuild containers and images. If you deploy Node.js in Docker or other container runtimes, rebuild your images with the patched base image (e.g., node:20.19.2-alpine) and redeploy.
3. Temporary workaround (if patching is not possible). Disable Brotli compression for HTTP/2 traffic. In Node.js this can be done by explicitly setting the content‑encoding header to identity or by configuring your reverse proxy to strip or reject br encoding. Note that this may degrade performance and should be considered a short‑term mitigation only.
4. Network‑level filtering. If you cannot patch immediately, consider blocking HTTP/2 traffic at the perimeter or forcing HTTP/1.1 for untrusted clients until the patch is applied.
5. Hunt for exploitation. Deploy the Sigma, KQL, and VQL detections provided above. Look for unexpected Node.js crashes, unusual child processes, or spikes in HTTP/2 traffic containing content‑encoding: br.
6. Monitor for updates. Subscribe to the Node.js security mailing list (https://groups.google.com/g/nodejs-sec) and CISA advisories for any updates on exploitation status or additional mitigations.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub