Skip to content
Monday, October 26, 2026
Built on napsite.com
Menu
Lazy TensorLazyTensor

Technology, Intelligence & Everything in Between.

Send a tipFree newsletter

Vulnerability Advisory

Critical CVE-2026-111497 Brotli Flaw Prompts Node.js and .NET Patches

Discovered by researcher backspaces, the integer wraparound in Google’s C Brotli decoder allows out-of-bounds memory writes via crafted compressed streams.

By Lazy Tensor
Published · 2 min read

Cybersecurity workstation in a dark operations room with dual monitors displaying network packet waveforms and code blocks
A security engineer inspects C decompression buffer allocation traces and network packet streams across dual monitors.
Your listening Queue & catch up
Unheard stories first, timed at 1×. Your selections stay first.

Add a story or build a catch-up queue to start listening.

Maintainers of Google's Brotli compression library, Node.js, Python's Brotli bindings, and Microsoft .NET have issued coordinated emergency patches for CVE-2026-111497 — a critical buffer overflow vulnerability dubbed "HTTP2Shell," "Node2Shell," and "Broccoli2Shell" that can lead to crashes or remote code execution when decompressing untrusted Brotli streams, BleepingComputer reported Monday.

The vulnerability was discovered and reported by software engineer and security researcher backspaces, who credited Justin Steven for assisting with coordinated disclosure across affected runtime vendors.

Integer Wraparound During Ringbuffer Reallocation

According to the technical advisory, CVE-2026-111497 resides in the C reference implementation of the Brotli decoder and affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0.

When the decoder processes a specially crafted compressed stream that triggers a reallocation of its sliding-window ringbuffer followed by a backward reference with a large negative distance value, an integer wraparound calculation produces an out-of-bounds write pointer. Depending on the surrounding allocator layout, an attacker can overwrite adjacent heap memory to crash the process or achieve arbitrary code execution.

Both HTTP Servers and Clients Exposed

Because Brotli (br) is widely enabled across modern HTTP/2 and HTTP/3 stacks as well as HTTP API clients, the flaw exposes two distinct attack surfaces:

  1. Server-Side Decompression: Web servers, API gateways, and Node.js or .NET backends that automatically decompress incoming HTTP requests carrying a Content-Encoding: br header.
  2. Client-Side Decompression: Scrapers, webhooks, SDKs, and Python HTTP libraries — including urllib3[brotli], requests, httpx, and aiohttp[speedups] — that advertise Accept-Encoding: br and decompress responses from untrusted origins.

Patched Releases Across Ecosystems

Administrators and developers are urged to upgrade immediately to the fixed releases:

  • Google Brotli C Library: Fixed in versions 1.0.10, 1.1.1, and 1.2.1.
  • Node.js: Fixed in v22.23.4 (LTS), v24.22.1 (LTS), and v26.12.1 (Current), which bundle the patched Brotli decoder.
  • Python: Fixed in Brotli package version 1.2.1 on PyPI.
  • Microsoft .NET: Addressed via out-of-band .NET runtime servicing updates.

Sources

Comments (0)

No comments yet. Be the first to share a thought on this story.

Request a correctionContact the newsroom

Lazy Tensor briefing

The ideas shaping technology and capital.

Independent reporting and analysis on the investors, companies, and technologies shaping tomorrow’s economy.

Subscribe to Lazy Tensor

Free to read. Unsubscribe anytime.

More from Lazy Tensor