Microsoft, Node.js Urgently Patch 'HTTP2Shell' Flaw: Critical RCE Risk in Brotli Compression Library Affects Millions of Sites
A severe out-of-bounds write vulnerability (CVE-2026-111497) has been discovered in Google's open-source Brotli compression library, enabling remote code execution. Microsoft, Node.js, and Python ecosystems have released patches, urging administrators to update immediately to prevent server takeover.
Multiple major tech companies have urgently patched a critical security vulnerability dubbed "HTTP2Shell." The flaw exists in Brotli, an open-source data compression algorithm developed by Google, tracked as CVE-2026-111497 with a severity score of 9.2/10 (critical). Brotli is widely used to compress HTTP responses such as HTML, CSS, and JavaScript, and is supported by most web browsers, servers, and software libraries.
According to the National Vulnerability Database, this is an out-of-bounds write defect that causes buffer overflow. An attacker who can supply specially crafted Brotli data for an application to decompress can corrupt process memory, leading to denial of service, memory disclosure, or in some cases, remote code execution (RCE). Similar to the recently publicized PHP vulnerabilities, but with a broader impact scope, it affects Node.js, Python packages (such as brotlicffi), HTTP clients (Requests, urllib3, httpx, aiohttp), and .NET applications.
Google fixed the bug on October 21, 2026, by releasing Brotli versions 1.0.10, 1.1.1, and 1.2.1. However, since many software bundles use vulnerable Brotli versions, updating Google's library alone may not protect every application. Microsoft subsequently released an emergency update for .NET over the weekend, stating that successful exploitation could lead to privilege escalation. Node.js also released its patch on October 21. Its official explanation noted: "An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer." Affected versions include Node.js 26.x, 24.x, and 22.x.