AI News Feed
Market watch
Florida surgeon removes prostate from 35 miles away in first U.S. telerobotic surgery between hospitalsArctic Fox’s Super Mouse puts a 3.1-inch touchscreen under the handTechRadar calls Phantom Blade Zero one of the year's best action gamesAmazon cuts Lenovo USB-C Slim Travel Dock by 23% to $50.04OpenAI and Anthropic Claim AI Models Refute Exponential Time HypothesisMicrosoft Adds Built-In Internet Speed Test to Windows 11
Florida surgeon removes prostate from 35 miles away in first U.S. telerobotic surgery between hospitalsArctic Fox’s Super Mouse puts a 3.1-inch touchscreen under the handTechRadar calls Phantom Blade Zero one of the year's best action gamesAmazon cuts Lenovo USB-C Slim Travel Dock by 23% to $50.04OpenAI and Anthropic Claim AI Models Refute Exponential Time HypothesisMicrosoft Adds Built-In Internet Speed Test to Windows 11
Cybersecurity

Microsoft, Google and Node.js patch critical HTTP2Shell Brotli flaw

Microsoft, Google and Node.js maintainers have released fixes for HTTP2Shell, a critical Brotli flaw tracked as CVE-2026-111497 that can cause memory corruption and, in some cases, remote code execution.

AI News Feed · 2026-10-28 03:10

HTTP2Shell was found in Brotli, a Google-built open source data compression algorithm used to reduce file sizes without losing information so that content such as HTML, CSS and JavaScript can be transmitted faster with less bandwidth. The bug is described as an out-of-bounds write flaw, also dubbed Node2Shell and Broccoli2Shell, and is tracked as CVE-2026-111497 with a severity score of 9.2 out of 10. According to the National Vulnerability Database, the buffer overflow could lead to memory disclosure, denial of service and, in some cases, remote code execution.

Brotli is used in Node.js, brotlicffi, HTTP clients such as Requests, urllib3, httpx and aiohttp, and other applications that use Brotli decoders, including Bun and Envoy deployments. Google fixed the bug on Oct. 21, 2026, by releasing Brotli versions 1.0.10, 1.1.1 and 1.2.1. Other software that bundles or uses vulnerable Brotli versions may still need separate updates.

Microsoft released an emergency update over the weekend to address the bug in .NET, saying successful exploitation could lead to privilege escalation. Node.js released its patch on Oct. 21 and said the vulnerability affected Node.js 26.x, 24.x and 22.x. In a statement, Node.js said an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, leading to a crash, disclosure of process memory or remote code execution. Patched Node.js versions are 22.23.4, 24.22.1 and 26.12.1. PyPI packages containing fixes became available on Oct. 23, BleepingComputer reported. Patched versions include Python Brotli 1.2.1 and Python brotlicffi 1.2.1.0.

A dedicated website, Broccoli2Shell.com, describes the issue, tracks vulnerable versions and reports on attempted exploits in the wild. The site says proof-of-concept exploits exist but that reports of malicious exploitation in the wild have not yet been seen. It said a public proof of concept appeared on GitHub on Oct. 22 and reportedly reaches code execution only on a deliberately weakened build; on standard builds it causes a crash and a limited memory read.

System administrators are advised to apply the patches as soon as possible, restart affected processes and rebuild and redeploy affected container images. Those who cannot do so immediately can reduce some risk. Python users should uninstall the vulnerable Brotli and brotlicffi packages and remove optional dependencies such as httpx[brotli]. Administrators can also configure proxies, load balancers or web application firewalls to reject incoming requests containing Brotli-compressed bodies, although this does not protect applications that download and decompress malicious HTTP responses. Node.js has no complete workaround, according to the report.

Editor's Summary

HTTP2Shell is a critical Brotli vulnerability that can cause memory corruption and, in some cases, remote code execution across Node.js, Python packages, .NET applications and other software. Google, Microsoft and Node.js maintainers have released fixes, but administrators must also update dependent software and container images. No in-the-wild exploitation has been confirmed, though a public proof-of-concept exploit exists.