▶️ Watch on YouTube: https://youtu.be/Mzlp-Brx1sk
🌐 Website: https://tekthrill.com
📺 Subscribe: https://youtube.com/@tekthrill
A critical flaw in Brotli, the Google compression library built into a huge amount of software, triggered emergency patches from Microsoft, Node.js, PHP and Python package maintainers between Oct 21 and Oct 26, 2026. Here is what it is, who is affected and exactly how to check and update.
Key facts (with sources):
• The bug is tracked as CVE-2026-111497 and nicknamed Node2Shell, HTTP2Shell and Broccoli2Shell. It affects Brotli 1.0.3 through 1.2.0; Brotli 1.0.10, 1.1.1 and 1.2.1 fix it (BleepingComputer, SecurityWeek).
• Node.js says a malformed stream made the decoder keep appending bytes to an eight-byte internal buffer, which can crash a process, leak memory or allow remote code execution. Google, which assigned the CVE, rates it 9.2 (critical, CVSS v4).
• An attack needs an app to decompress attacker-controlled Brotli data, e.g. a compressed response from a server it fetches or a compressed request sent to a server.
• Node.js credited OpenAI Codex Security. OpenAI says the root cause was fixed in Brotli's source in February 2026, but it was not known to be a security issue and there was no new release.
• Oct 21, 2026: Node.js and Google shipped fixes; public disclosure followed the next day (BleepingComputer). Oct 23: fixed Python packages. Oct 25: Microsoft out-of-band updates for .NET, Visual Studio and PowerShell. Oct 26: PHP rebuilt Windows packages.
• No exploitation in the wild has been reported. Imperva says it achieved code execution in testing on an official Node.js build, not on every attempt; some researchers argue it is mainly a crash risk. Microsoft rates exploitation "more likely".
How to update:
• Node.js: run node -v. Fixed: 22.23.4, 24.22.1, 26.12.1.
• .NET: run dotnet --list-runtimes. Fixed: 8.0.33, 9.0.22, 10.0.14, .NET 11 RC3. Brotli decompression is off by default and .NET Framework is not affected (Microsoft). Rebuild self-contained apps.
• Visual Studio 2019, 2022, 2026: update via the Visual Studio Installer.
• PHP on Windows: new builds 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1 with Brotli 1.2.1 (PHP.net).
• Python: pip install --upgrade brotli brotlicffi. Fixed: Brotli 1.2.1, brotlicffi 1.2.1.0.
• Restart services and rebuild container images. Normal users: run Windows Update and restart.
Chapters:
0:00 Why you should patch now
0:32 What is Brotli?
0:53 What went wrong (CVE-2026-111497)
1:36 Timeline: Feb fix to Oct patches
2:11 Is it being exploited?
2:33 Developer checklist: Node.js, .NET, Visual Studio, PHP, pip
4:03 For normal Windows users
4:15 The bigger lesson
Have you patched yet? Tell us in the comments.
Try free AI tools 👉 https://tekthrill.com
Subscribe to TEKTHRILL for daily AI and tech news.
Sources:
BleepingComputer: https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
