Test your HTTP client
Fetch the test URL with your client to check its Brotli decoder.
Test your HTTP client
Outbound
Your client fetches a URL on this site that serves the crafted
Brotli stream. A client that auto-decompresses
Content-Encoding: br with an affected decoder may
crash. Run it in a disposable process or container.
The stream is only sent to clients that advertise Brotli in
Accept-Encoding; others get a 406. Some clients
decode Brotli without advertising it. Node’s built-in
fetch, for example, sends
gzip, deflate, so add ?force_br=true
to the URL.
Run it from your client
- Node.js
node -e "fetch('https://brotli.aikidosec.com/br?force_br=true')"- Python
python3 -c "import faulthandler; faulthandler.enable(); import requests; requests.get('https://brotli.aikidosec.com/br')"- curl
curl --compressed https://brotli.aikidosec.com/br- PHP
php -r '$ch = curl_init("https://brotli.aikidosec.com/br"); curl_setopt($ch, CURLOPT_ACCEPT_ENCODING, ""); curl_exec($ch);'- Git
git clone https://brotli.aikidosec.com/br
A process killed by a signal (segmentation fault, bus error,
abort) likely has an affected Brotli decoder. A 406 means the
client never asked for Brotli and was not tested. Python Requests
needs an installed Brotli decoder; PHP needs the cURL extension
with Brotli support. Git clone and fetch request paths under
/br/, which serve the same stream. This is not a Git
repository: surviving Git clients will report a decode or
protocol error rather than complete a clone.
Patch guidance
Release guidance dated 27 October 2026, not a live patch-status feed. Confirm current fixes in the advisory and your vendor’s release notes.
| Stack | Decoder source | What to verify |
|---|---|---|
| Node.js (bundled decoder) | Bundled with Node |
Known fixed releases: Node 22.23.4, 24.22.1, and 26.12.1.
Upgrade to the fixed release or newer on your supported line.
Updating an npm package does not replace the bundled decoder.
node -v
|
| Python (brotli / Brotli PyPI) | Python package |
Known fixed package: Brotli 1.2.1 or newer. Update it in every
deployed environment; Requests itself does not need changing.
python3 -m pip show Brotli
python3 -m pip install --upgrade 'Brotli>=1.2.1'
|
| curl & git (libbrotli) | System libbrotli |
Find which libbrotli your curl links, then check that package
in every host and image. Vendors often backport the fix
without changing the upstream version number, so compare
against their security advisory.
curl -V
|
| PHP (libcurl path) | libcurl and its decoder |
Identify the Brotli library used by your libcurl build, apply
the vendor’s security update, and restart PHP workers.
php -r 'print_r(curl_version());'
|
| Java (Brotli4j) | Brotli4j native libraries |
Known fixed release: Brotli4j 1.24.0. Replace 1.23.0 and
update matching Java, native, and service JARs together.
Check release notes for newer security updates.
mvn dependency:tree -Dincludes=com.aayushatharva.brotli4j
gradle dependencyInsight --dependency brotli4j
|
| .NET | Runtime decoder |
Consult the Microsoft advisory and security releases for your
supported runtime; verify the installed runtime after updating.
dotnet --list-runtimes
|
Go and Ruby ship their own Brotli stacks or link the system library;
check go version -m or gem list brotli and
the libbrotli version in your images. Envoy links a bundled or system
Brotli; check your build.
About the check
What we’re checking, and what you should know before you run it.
What is the vulnerability?
CVE-2026-111497 (“Node2Shell”) is an out-of-bounds write in
Google's Brotli decoder (c/dec/decode.c), affecting versions 1.0.3
through 1.2.0. A crafted Brotli stream can crash the decoding
process, leak memory, or, in demonstrated proofs of concept,
execute code. It reaches any stack that decompresses Brotli:
client auto-decompression of Content-Encoding: br
responses, and server-side inflation of compressed request bodies.
Will the check affect my systems?
This check runs in your own HTTP client and may crash its process. Only test clients you are authorized to test.
Does a clean result mean I'm safe?
No. No crash signal can mean a patched decoder, a buffering layer, a rejected request, or an untested code path. Crashes are also build- and platform-dependent. Check the actual decoder build and vendor security updates in every image and binary you ship.
Security should be simple. Knowing is a good place to start.
Meet Aikido