Cybersecurity
Brotli flaw prompts emergency patches across Node.js and .NET
A buffer overflow in the Brotli compression library, tracked as CVE-2026-111497, affected multiple software stacks, prompted fixes from Google, Node.js and Microsoft, and had no confirmed abuse in the wild.
- The flaw was tracked as CVE-2026-111497 and affected Brotli releases 1.0.3 to 1.0.9, 1.1.0 and 1.2.0.
- It was first found in Node.js and later linked to the same Brotli decoder used by other software.
- Node.js said the bug could crash affected processes, expose memory and allow remote code execution.
- Microsoft issued an emergency .NET update on Sunday, while Google, Node.js and Python package maintainers published fixes on 21 and 23 October.
- The article said proof-of-concept exploits had been published, but there were no reports of malicious use in the wild.
The issue was given several names, including HTTP2Shell, Broccoli2Shell and Node2Shell, after researchers linked an initial Node.js finding to the same fault in Brotli. Brotli is a Google-maintained open-source compression project used to reduce file sizes for transfer.
The bug affected Brotli 1.0.3 through 1.0.9, 1.1.0 and 1.2.0. It could be triggered when an application unpacked attacker-supplied Brotli data, including from a compressed response fetched from a URL or a compressed request sent to a server.
Node.js described the weakness as a buffer overflow caused by the decoder treating an invalid block switch as a request for more input. The article said Microsoft also pushed an emergency update for .NET after warning that exploitation could raise privileges on vulnerable systems.
Google, Node.js and the Python package maintainers released fixed versions on 21 and 23 October. The patched releases listed were Google Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js 22.23.4, 24.22.1 and 26.12.1; Python Brotli 1.2.1; and brotlicffi 1.2.1.0.
Named in this story
Companies
- the maintainer that released fixed Brotli versions
- Microsoft
- the vendor that pushed the .NET security update
- Imperva
- the security company that said exploitation could lead to remote code execution
Products and systems
- Brotli
- the compression library affected by the flaw
- Node.js
- the runtime where the issue was first identified and described
- .NET
- the Microsoft framework that received an emergency update
- urllib3[brotli]
- a Python HTTP client package named as potentially affected
- requests
- a Python HTTP client package named as potentially affected
- httpx
- a Python HTTP client package named as potentially affected
- aiohttp[speedups]
- a Python HTTP client package named as potentially affected
- Python Brotli
- a Python package that received a fixed release
- brotlicffi
- a Python package that received a fixed release
How the source tells it
The piece reads as a technical security notice, with a modest urgency bias created by severity labels and repeated patching advice.
- urgency severity labels and repeated calls to update immediately