The HTTP2Shell Brotli vulnerability (CVE-2026-111497) had no impact on the Fireblocks platform or your assets. We upgraded Node.js and validated our use of Brotli across our infrastructure.
On October 21, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write in the Brotli decoder that permits remote code execution. It affects Node.js 22.x, 24.x, and 26.x. Fireblocks assessed the vulnerability as soon as it was disclosed. It has since become clear that the impact is broader: the brotli and brotlicffi packages for Python are also affected.
What you need to do
Node.js
If you run your own Node.js applications, including custom software built on the Fireblocks SDK, upgrade to the patched version for your release line: 22.23.4, 24.22.1, or 26.12.1.
Python
The Fireblocks Python SDKs, including the legacy fireblocks-sdk, do not require Brotli. They use requests and urllib3, which can negotiate and decode Brotli responses if the brotli or brotlicffi package is installed in the same environment. If either package is installed, upgrade to brotli 1.2.1 or brotlicffi 1.2.1.0. If you do not need them, uninstall them. Gzip and deflate keep working without them.
Other software
If you run other software that decodes Brotli, such as HTTP clients, reverse proxies, or API gateways, install the vendor's patched release.
For more details, see the Node.js security release announcement, the Brotli package on PyPI, and the GitHub security advisory.