The HTTP2Shell Timeline
Klaas van Schelven;
October 25 - 3 min read
I couldn’t actually find any public timeline of the Node2Shell/HTTP2Shell/Brotli vulnerability. So I had Codex generate one.
The reason for asking was: this made the public record as Node2Shell, suggesting something node-specific, and only later was it noted that it “escalated” to other languages. But given the dependecy tree (all those packages/languages depend on Brotli, and that’s where the vulnerability sits), that ordering is super-weird. Why wasn’t this Brotli to begin with? And why did Node get to publish a fix before the actual upstream releases?
Anyway, here’s what I/it could find:
| When | What happened |
|---|---|
| Feb 27, 13:10 | Google commits the fix. It is presented as decoder correctness work, not security, and isn't released. |
| Oct 6–13 | Envoy versions later listed as fixed are released. Their release notes don't mention this Brotli bug. |
| Oct 16, 09:58 | Google reserves CVE-2026-111497. This isn't public disclosure, but it is hard evidence that Google knew. |
| Oct 20, 14:59 | Node commits its fix through a private security PR. The commit points straight at Google's February Brotli fix. |
| Oct 20, 17:05 | Istio publicly adds the CVE to its bulletin. It calls this a vulnerability in the Brotli library used by Envoy. Not a Node bug. |
| Oct 21, 10:38 | Node.js
publishes its security release.
Its release notes say: deps: brotli: cherry-pick 0ed4268a... |
| Oct 21, 13:47 | A Bun PR applies the same upstream fix. The follow-up issue says Bun and Node compile the same vulnerable decoder source. |
| Oct 21, 19:27 | Google finally publishes the upstream Brotli releases: 1.0.10, 1.1.1 and 1.2.1. About 8 hours and 49 minutes after Node. |
| Oct 22, 13:35 | Google publishes the full CVE record. Its title: "Out-of-Bounds Write in Google Brotli Decoder". |
| Oct 22, 13:57 | Fixed Python Brotli wheels start arriving on PyPI; brotlicffi follows at 16:19. |
| Oct 22 | Imperva publishes its Node.js exploit work and calls it Node2Shell. |
| Oct 23 | Aikido publishes "Node2Shell evolves to HTTP2Shell". |