Microsoft and others scramble to patch ‘HTTP2Shell’ flaw that could be the next PHP-level issue – Node.js issue may also affect millions of sites
follow us
Add us as a preferred source on Google
- A critical flaw in Brotli compression, called HTTP2Shell, could allow memory corruption and remote code execution
- The vulnerability affects commonly used software, including Node.js, Python packages, and .NET applications.
- Vendors have released patches and administrators are urged to update them immediately even though no exploitation has been confirmed in the wild.
Several companies and technology projects have recently released patches for a vulnerability called “HTTP2Shell” that could allow remote code execution (RCE) attacks, similar to the recent “PHP2Shell” vulnerabilities.
HTTP2Shell was found in Brotli, an open source data compression algorithm created by Google that reduces file sizes without losing information, thus achieving faster transmission times and using less bandwidth.
It is a popular algorithm used on the web to compress HTTP responses such as HTML, CSS, and JavaScript, and is supported by most web browsers, servers, and software libraries.
Latest videos ofTechnologyRadar
Fixes and patches
The error itself is described as an out-of-bounds write error and is also called Node2Shell and Broccoli2Shell. It is tracked as CVE-2026-111497 and was assigned a severity score of 9.2/10 (critical). According to the National Vulnerability Database, the bug causes a buffer overflow that could lead to memory disclosure, denial of service, and in some cases even remote code execution.
Brotli can be found in all types of software, all of which are now at risk. This includes Node.js, brotlicffi, HTTP clients such as Requests, urllib3, httpx and aiohttp, but also other applications that use Brotli decoders, such as Bun and Envoy implementations.
Google fixed the bug on October 21, 2026 by releasing Brotli versions 1.0.10, 1.1.1, and 1.2.1. However, there are other software that include or use vulnerable versions of Brotli, so updating the Google library alone may not protect all applications.
Over the past weekend, Microsoft released an emergency update to fix the bug in .NET, saying that a successful exploit could lead to privilege escalation.
Since it also includes the Brodli decoder, Node.js also released its patch on October 21. “An invalid block change was reported as a temporary need for more input rather than a permanent format error, so the streaming decoder continued adding input bytes to an internal eight-byte buffer,” the organization explained. “An attacker who is able to provide Brotli data that an application decompresses with node:zlib can corrupt process memory, potentially leading to a crash, process memory disclosure, or remote code execution.”
The vulnerability was said to affect Node.js 26.x, 24.x, and 22.x.
beepcomputer reports that PyPI packages containing the fixes became available two days later, on October 23.
Here is a detailed list of patched versions:
Google Brotli 1.0.10, 1.1.1, 1.2.1
Node.js 22.23.4, 24.22.1, 26.12.1
Python Brotli 1.2.1
Python brotlicffi 1.2.1.0
Dedicated website
At the same time, someone created an exclusive website, Broccoli2Shell.comthat describes the issue, tracks vulnerable versions, and reports exploitation attempts in the wild. On the site, it is said that proof-of-concept (PoC) exploits already exist for the bug, but no reports of malicious exploitation have yet been seen in the wild.
“A public proof of concept appeared on GitHub on October 22, 2026,” the site reads. “It reportedly achieves code execution only in a deliberately weakened version. In standard versions it causes a crash and limited memory read.”
System administrators are recommended to apply the provided patches as soon as possible; Restart affected processes and rebuild and redeploy affected container images.
Those who cannot do so immediately can mitigate the risks to some extent. Python users should uninstall the vulnerable Brotli and brotlicffi packages and remove optional dependencies such as httpx.[brotli].
Administrators can also configure proxy servers, load balancers, or web application firewalls (WAFs) to reject incoming requests that contain Brotli-compressed bodies. It’s worth mentioning that this does not protect applications that download and decompress malicious HTTP responses.
It was said that Node.js does not have a complete solution.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment