brotli2scan

Is your website affected by HTTP2Shell?

HTTP2Shell (CVE-2026-111497) is a critical bug in the Brotli decompression library. Attackers can crash servers or run code on them by sending crafted Brotli data. It affects Node.js, Python, .NET, Envoy and more. Enter your website to see which of them it runs on.

The check loads your start page the same way a browser does. Abuse may be reported to the authorities.

Need more? Run it yourself.

This page checks one website at a time. The free command-line version does a lot more: whole IP ranges, a port scan, every website hosted on the same server, CSV export, the Brotli test against your API routes, and no limits. One Python file, nothing to install.

# download one file, run it
curl -LO https://github.com/akaihigurashi/brotli2scan/releases/latest/download/brotli2scan.py
python3 brotli2scan.py 203.0.113.0/24 -b

# only scan systems you're allowed to test