Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue Node.js problem may also affect millions of sites

Date:
Tue, 27 Oct 2026 18:45:00 +0000

Description:
An RCE flaw was found in Brotli, a Google-built open source data compression algorithm.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter A critical Brotli compression flaw, dubbed HTTP2Shell, could enable memory corruption and remote code execution The vulnerability affects widely used software including Node.js, Python packages, and .NET applications Vendors released patches, and administrators are urged to update immediately despite no confirmed in-the-wild exploitation Multiple tech companies and projects have recently pushed patches for a vulnerability called HTTP2Shell which could enable
remote code execution (RCE) attacks, similar to the recent PHP2Shell vulnerabilities.

HTTP2Shell was found in Brotli, a Google -built open source data compression algorithm that reduces file sizes without losing information, thus achieving faster transmission times while using less bandwidth. It is a popular algorithm used on the web to compress HTTP responses such as HTML, CSS, and JavaScript, and is supported by most web browsers, servers, and software libraries. Latest Videos From TechRadar Watch full video here: Fixes and patches The bug itself is described as an out-of-bounds write flaw, and is also dubbed Node2Shell, and Broccoli2Shell. It is tracked as CVE-2026-111497, and was given a severity score of 9.2/10 (critical). According to the
National Vulnerability Database, the bug causes a buffer overflow which could lead to memory disclosure, denial of service and, in some cases, even remote code execution.

Brotli can be found in all sorts of software, all of which is now at risk. That includes Node.js, brotlicffi, HTTP clients such as Requests, urllib3, httpx and aiohttp, but also other apps that use Brotli decoders such as Bun and Envoy deployments. You may like Website admins across the world bracing for impact following major PHP flaw reveal PHP security issues could also threaten your NAS device but not every vendor is able to patch just yet PHP releases emergency fixes as some of the world's biggest websites say they
were targeted by hackers

Google fixed the bug on October 21 2026, by releasing Brotli versions 1.0.10, 1.1.1, and 1.2.1. However, there are other software that either bundle or use vulnerable Brotli versions, so updating Googles library alone may not protect every application.

Over the last weekend, Microsoft released an emergency update to sort the bug in .NET, saying successful exploitation could lead to privilege escalation. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Since it also bundles the Brodli decoder, Node.js released its patch on October 21, too. An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer, the organization explained. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution .

The vulnerability was said to be affecting Node.js 26.x, 24.x, and 22.x.

BleepingComputer reports that PyPI packages containing the fixes became available two days later, on October 23. What to read next Experts reveal another major PHP2Shell bug and it's not getting an emergency patch this
time No, the internet isn't dying due to 'one of the most significant vulnerabilities of 2026' - but this is what you need to know AWS says hackers tried to exploit PHP security issues days before fix as Cloudflare CEO says it saw a huge rise in targeted attack attempts

Here is a detailed list of patched versions:

Google Brotli 1.0.10, 1.1.1, 1.2.1

Node.js 22.23.4, 24.22.1, 26.12.1

Python Brotli 1.2.1

Python brotlicffi 1.2.1.0 Dedicated website At the same time, someone set up
a dedicated website, Broccoli2Shell.com , which describes the issue, tracks vulnerable versions, and reports on attempted exploits in the wild. On the site, it is said that proof-of-concept (PoC) exploits for the bug already exist, but reports of malicious exploitation in the wild are yet to be seen.

A public proof of concept appeared on GitHub on 2026-10-22, the site reads.
It reportedly reaches code execution only on a deliberately weakened build.
On standard builds it causes a crash and a limited memory read.

System administrators are advised to apply the provided patches as soon as possible; restart affected processes and rebuild and redeploy affected container images.

Those that cannot do that immediately can somewhat mitigate the risks. Python users should uninstall the vulnerable Brotli and brotlicffi packages and remove optional dependencies such as httpx[brotli].

Admins can also configure proxies, load balancers or web application
firewalls (WAF) to reject incoming requests containing Brotli-compressed bodies. Its worth mentioning that this doesnt protect apps that download and decompress malicious HTTP responses.

Node.js has no complete workaround, it was said. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/microsoft-and-others-scramble-to-patch- http2shell-flaw-which-could-be-the-next-php-level-issue-node-js-problem-may-al so-affect-millions-of-sites


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)