Critical Brotli Flaw Prompts Urgent Patches Across Software Makers

WHO:

BleepingComputer - The vulnerability affects Brotli, an open-source lossless data-compression project developed and maintained by Google, and is built into Node.js.

BleepingComputer - Potentially affected software includes Node.js; Python HTTP clients urllib3[brotli], requests, httpx, and aiohttp[speedups] when configured with a vulnerable Brotli decoder; and other applications and tools using vulnerable Brotli implementations.

BleepingComputer - Microsoft issued an emergency security update for .NET; Google and Node.js released stable fixes, and PyPI packages containing fixes became available.

BleepingComputer - Cybersecurity company Imperva reported that exploiting CVE-2026-111497 can lead to remote code execution.

WHAT:

BleepingComputer - Microsoft released out-of-band security updates for .NET 8, .NET 9, and .NET 10, as well as .NET 11 Release Candidate 3.

BleepingComputer - A critical Brotli vulnerability, tracked as CVE-2026-111497 and also called “HTTP2Shell,” “Broccoli2Shell,” and “Node2Shell,” can corrupt memory, expose sensitive data, crash processes, and enable remote code execution.

BleepingComputer - The issue affects Brotli versions 1.0.3 through 1.0.9, as well as versions 1.1.0 and 1.2.0.

BleepingComputer - Microsoft warned that successful exploitation can allow privilege escalation on systems running a vulnerable .NET version.

BleepingComputer - Proof-of-concept exploits have been published; the article reports no malicious exploitation in the wild.

BleepingComputer - Patched versions are Google Brotli 1.0.10, 1.1.1, and 1.2.1; Node.js 22.23.4, 24.22.1, and 26.12.1; Python Brotli 1.2.1; and Python brotlicffi 1.2.1.0.

WHERE:

BleepingComputer - The flaw can affect HTTP clients and servers, as well as other applications that decompress attacker-controlled Brotli data; it is not limited to HTTP/2.

WHY:

BleepingComputer - The vulnerability was initially identified in Node.js; researchers later found the same flaw in the Brotli decoder could affect software across multiple ecosystems.

HOW:

BleepingComputer - Microsoft said the flaw may affect applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or .NET’s System.IO.Compression Brotli APIs. Brotli decompression is not enabled by default in .NET or ASP.NET Core; applications must opt in or invoke the APIs manually.

BleepingComputer - A specially crafted compressed stream can trigger an invalid block switch that the decoder treats as a request for more input. The decoder then appends bytes beyond an internal eight-byte buffer, corrupting nearby memory. Node.js said: “An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer.”

BleepingComputer - An attacker can cause an application to decompress malicious data by serving it in a compressed HTTP response or sending a compressed request directly to a server.

BleepingComputer - Administrators should apply updates, restart affected processes, and rebuild and redeploy affected container images. Updating the system Brotli library may not fix Node.js deployments or apps with bundled copies; blocking inbound Brotli requests does not block the malicious-response route. If an update is unavailable, the article recommends removing Brotli support from Python applications and blocking incoming Brotli-compressed requests at a proxy or firewall.

(UPDATED October 26, 2026 22:07 UTC)

A critical flaw in Google’s Brotli compression software can corrupt memory, expose sensitive data, crash applications, and potentially allow remote code execution or privilege escalation; proof-of-concept exploits are public, but no malicious use has been reported. The vulnerability affects multiple Brotli versions and software across ecosystems, including Node.js, some Python clients, and .NET applications that enable Brotli decompression, and it can be triggered through malicious compressed requests or responses. Microsoft has issued emergency .NET updates, while Google, Node.js, and Python package maintainers have released fixes; administrators should update affected software, restart processes, and rebuild and redeploy vulnerable containers.

--

(UPDATED October 26, 2026 19:23 UTC)

A critical flaw in Google’s Brotli compression software can corrupt memory and expose sensitive data, crash applications, escalate privileges in vulnerable .NET systems, or enable remote code execution. The vulnerability affects a range of Brotli versions and software including Node.js and some Python HTTP clients; proof-of-concept exploits are public, but no malicious attacks have been reported, and security updates are available from Microsoft, Google, Node.js, and PyPI. Administrators should update affected software, restart processes, and rebuild and redeploy affected containers, since updating a system library may not fix applications with bundled Brotli copies.