Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

Key Points:

• A critical buffer overflow vulnerability named HTTP2Shell (CVE-2026-111497) in the Brotli C decoder library used by Node.js and other software allows attackers to corrupt memory, potentially leading to remote code execution and data exposure.
• The flaw affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0, impacting multiple ecosystems including Python HTTP clients and .NET, with Microsoft issuing an emergency update to address privilege escalation risks.
• The vulnerability arises from a misinterpreted invalid block switch in the Brotli stream, causing an internal buffer overflow when decompressing maliciously crafted Brotli data, which can crash processes or enable remote code execution.
• Stable patches were released by Google, Node.js, and Python package maintainers in October 2026, with users urged to update immediately, restart affected services, and rebuild container images; proof-of-concept exploits exist but no active attacks have been reported.
• Workarounds include removing Brotli support from Python applications and blocking Brotli-compressed requests at the network level, as updating the system Brotli library alone does not fully mitigate the risk in all environments.