Brotli CVE-2026-111497 on CentOS 7, RHEL and Amazon Linux 2: Fix libbrotli

The Brotli CVE everyone is asking about, CVE-2026-111497 (HTTP2Shell), is a bug in the Brotli decoder. On CentOS 7 and Amazon Linux 2 the fix is libbrotli 1.2.1 from GetPageSpeed, because EPEL 7 is archived at the vulnerable 1.0.9. RHEL, Rocky Linux and AlmaLinux 8 to 10 get it from their own vendor. NGINX’s Brotli compression module only compresses, so it is not affected.

CVE-2026-111497  Google Brotli decoder out-of-bounds write (c/dec/decode.c), CWE-787
Also known as:   HTTP2Shell (F5), Broccoli2Shell, Node2Shell; GHSA-9v8h-qqgm-4m35
Affected:        Google Brotli 1.0.3 through 1.2.0
Fixed upstream:  1.0.10, 1.1.1, 1.2.1
Severity:        Red Hat: Important, CVSS 3.1 8.1; listed in CISA KEV
CentOS 7 EPEL:   libbrotli 1.0.9-10.el7, archived, no fix
CentOS 7 fix:    libbrotli 1.2.1 from extras.getpagespeed.com (x86_64, aarch64)
Amazon Linux 2:  libbrotli 1.2.1 from extras.getpagespeed.com (x86_64, aarch64)

How to fix the Brotli CVE on CentOS 7 and Amazon Linux 2

yum -y install https://extras.getpagespeed.com/release-latest.rpm
yum -y update libbrotli brotli
rpm -q libbrotli

Free to install; commercial production use requires a subscription.

The last command must print a libbrotli-1.2.1 build, for example libbrotli-1.2.1-5.el7.x86_64 on CentOS 7 or libbrotli-1.2.1-5.amzn2.x86_64 on Amazon Linux 2. If it prints package libbrotli is not installed, nothing on the server uses the system Brotli library. Otherwise, that one package fixes every program on the server that links the system Brotli library, including NGINX, curl and OpenSSL. Restart the long-running ones afterwards, because a running process keeps the old library mapped until it restarts:

systemctl restart nginx

On CentOS 7 the first command also repoints the dead mirrorlist.centos.org entries at a maintained vault, so yum works again on servers where it had stopped.

The fixed builds are published for both x86_64 and ARM64 (aarch64).

RHEL, Rocky Linux and AlmaLinux 8, 9 and 10

Your vendor ships the fix, so a normal update is enough:

dnf -y upgrade --refresh libbrotli brotli
rpm -q --changelog libbrotli brotli | grep CVE-2026-111497

In testing, AlmaLinux 9.8 updated to libbrotli-1.0.9-10.el9_8.1 and AlmaLinux 10.2 to libbrotli-1.1.0-8.el10_2.1. On EL8 the library sits inside the brotli package, fixed in brotli-1.0.6-5.el8_10. All three changelogs name CVE-2026-111497. With the GetPageSpeed repository enabled on EL8, the same command moves you to brotli and libbrotli 1.2.1 instead, which is also fixed.

Debian and Ubuntu

apt-get update
apt-get install --only-upgrade libbrotli1
dpkg-query -W libbrotli1

Fixed releases are 1.0.9-2+deb12u1 on Debian 12, 1.1.0-2+deb13u1 on Debian 13, 1.0.9-2ubuntu0.1 on Ubuntu 22.04 and 1.1.0-2ubuntu0.1 on Ubuntu 24.04. Ubuntu 16.04, 18.04 and 20.04 get the fix only through Ubuntu Pro.

What CVE-2026-111497 is

The flaw is an out-of-bounds write in the Brotli decoder, c/dec/decode.c. Red Hat places it in the block-type switch handling. A crafted Brotli-compressed stream can corrupt adjacent decoder state. According to the CVE record, a remote unauthenticated attacker can then disclose memory, cause a denial of service, or potentially execute code. The record was published on October 22, 2026, and CISA has added it to the Known Exploited Vulnerabilities catalog.

The trigger is always the same: a program decompresses Brotli data that an attacker controls. Red Hat rates the flaw Important rather than Critical because it scores attack complexity as high. Google’s fix shipped as Brotli 1.2.1, with 1.0.10 and 1.1.1 for older branches.

Is NGINX affected by the Brotli CVE?

Stock NGINX does not link Brotli at all. What matters is which Brotli module you load:

Package	What it does with Brotli	Affected?	What to do
nginx-module-brotli (ngx_brotli)	Compresses responses, serves .br files	No: encoder only	Nothing for this CVE
nginx-module-unbrotli	Decompresses br responses from upstreams	Yes, through the system library	yum update libbrotli
curl-latest, libcurl-latest	Decompresses br HTTP responses	Yes, through the system library	yum update libbrotli
openssl35, openssl35-libs	Decompresses received TLS certificates (RFC 8879)	Yes, through the system library	yum update libbrotli

F5 K000163902 reaches the same verdict for NGINX Plus: its Brotli module compresses responses or serves pre-compressed files and never decompresses, so it needs no update. F5 still tells you to update the operating system’s Brotli library for the other programs on the server.

The GetPageSpeed builds agree. On CentOS 7, ldd shows ngx_http_brotli_filter_module.so linking only libbrotlienc and libbrotlicommon, and ngx_http_brotli_static_module.so linking no Brotli library at all. ngx_http_unbrotli_filter_module.so links libbrotlidec, the decoder. None of these modules bundles its own copy of Brotli, so the library update fixes them without reinstalling NGINX. If you have not set up Brotli compression yet, see how to install the NGINX Brotli module.

The NGINX unbrotli module is the one to care about. A backend that sends Content-Encoding: br hands its compressed body straight to the decoder. A compromised or hostile upstream therefore reaches the vulnerable code. On a fixed libbrotli, keep using it as before:

yum -y install nginx-module-unbrotli

Free to install; commercial production use requires a subscription. Without one, a small license notice appears on HTML pages after 30 days.

Check whether your server is vulnerable

First, the library version:

rpm -q libbrotli brotli

Anything from 1.0.3 to 1.2.0 without a vendor fix is vulnerable, and that includes EPEL 7’s libbrotli-1.0.9-10.el7. Next, list what on the server uses the decoder:

rpm -q --whatrequires 'libbrotlidec.so.1()(64bit)'

On a CentOS 7 test server with curl-latest, nginx-module-brotli and nginx-module-unbrotli installed, that printed brotli, openssl35-libs, libcurl-latest, curl-latest and nginx-module-unbrotli. nginx-module-brotli is absent because it never touches the decoder. Note that rpm -q --whatrequires libbrotli prints no package requires libbrotli: packages depend on the library’s sonames, not on the package name.

To check a single binary or module, use ldd:

ldd /usr/lib64/nginx/modules/ngx_http_unbrotli_filter_module.so | grep brotli

A line pointing at /lib64/libbrotlidec.so.1 means the module uses the system library, so the libbrotli update covers it. curl-latest --version prints brotli/1.2.1 once the fixed library is installed.

Finally, check for processes still running the old library after the update:

grep -l 'libbrotlidec.*(deleted)' /proc/[0-9]*/maps 2>/dev/null

Each path printed belongs to a process that needs a restart.

Python Brotli bindings on CentOS 7

The Python bindings compile Brotli into their own extension module, so they are not covered by libbrotli. Two old GetPageSpeed subpackages are still at 1.0.7: python-brotli and python34-brotli.

python-brotli is replaced automatically. python2-brotli 1.2.1 obsoletes it, so yum update swaps it in, and the import afterwards reports 1.2.1.

Since 1.2.1-3, python36-brotli obsoletes python34-brotli the same way. If rpm -q python34-brotli still shows 1.0.7 after yum update, install the Python 3.6 build and remove the old one:

yum -y install python36-brotli
yum -y remove python34-brotli

Do not run yum remove python-brotli on a fixed server. python2-brotli provides the name python-brotli, so yum removes the fixed package instead.

Why CentOS 7 has no other fix

Debian, Ubuntu, Red Hat and AlmaLinux all shipped fixed packages within days. CentOS 7 had none of those channels left. Its Brotli came from EPEL 7, and EPEL 7 is archived: its last build is libbrotli-1.0.9-10.el7, squarely inside the affected range, and it will never be updated. Amazon Linux 2 servers that took Brotli from EPEL are in the same position.

GetPageSpeed’s libbrotli 1.2.1 uses the same package split as Fedora and EPEL. In testing on CentOS 7.9 it upgraded EPEL’s libbrotli-1.0.9-10.el7 in place with one yum update, with no conflicts.

How these commands were verified

Every command above was run in clean containers: CentOS 7.9, Amazon Linux 2, and AlmaLinux 8.10, 9.8 and 10.2, all x86_64. On CentOS 7 the test installed EPEL’s vulnerable libbrotli-1.0.9-10.el7 first, then ran the fix commands. After the update, ldd showed every Brotli consumer resolving to the 1.2.1 library, curl-latest --version reported brotli/1.2.1, and the Python checks behaved as described.

FAQ

Is ngx_brotli affected by CVE-2026-111497?

No. ngx_brotli, packaged as nginx-module-brotli, compresses responses and serves pre-compressed files. It never decompresses, so it never runs the vulnerable decoder. F5 says the same about the NGINX Plus Brotli module.

Do I need to reinstall NGINX?

No. The NGINX Brotli modules link the system library, so yum update libbrotli fixes them. Restart NGINX so the workers load the new library.

Is CentOS 7’s EPEL brotli package fixed?

No. EPEL 7 is archived at libbrotli-1.0.9-10.el7, which is vulnerable. Install libbrotli 1.2.1 from the GetPageSpeed repository instead.

Can I block the attack in NGINX instead?

F5’s interim advice for its own products is to reject requests with Content-Encoding: br. That helps only where the server decompresses request bodies. It does nothing for nginx-module-unbrotli, curl or OpenSSL, which receive Brotli data from the other side of the connection. Update the library.

Conclusion

The Brotli CVE is a decoder bug, so the fix belongs in the library, not in NGINX. On RHEL, Rocky Linux and AlmaLinux 8 to 10 your vendor has it. On CentOS 7 and Amazon Linux 2, yum update libbrotli from the GetPageSpeed repository brings 1.2.1 and covers NGINX, curl and OpenSSL in one step.

The library is rarely the only stale package on a CentOS 7 server. If the same box runs PHP, check PHP2Shell on CentOS 7 next. Everpatch for CentOS 7 lists everything GetPageSpeed keeps patched for EL7, from the kernel to PHP and the NGINX modules.

A patched library does not keep a config patched. The NGINX in front of these services drifts one change at a time. GetPageSpeed Amplify runs scheduled gixy scans across every host and ties findings to live NGINX runtime metrics. Drop-in compatible with the deprecated nginx-amplify-agent (EOL January 2026).

Running these servers for a business? A GetPageSpeed subscription covers the NGINX builds and modules on every supported distribution, including CentOS 7 and Amazon Linux 2.