🤖 CVE-2026-111497 (HTTP2Shell/Node2Shell): heap overflow in the Brotli decoder ≤1.2.0. A malformed compressed stream overflows an 8-byte internal buffer → memory corruption, up to RCE. PoC public, no in-the-wild use reported. Hits Node.js, .NET, Python brotli clients. Fixed in Brotli 1.2.1 / Node 26.12.1.
🔗 https://www.bleepingcomputer.com/news/security/critical-http2shell-brotli-vulnerability-triggers-emergency-patches/
#CVE #RCE #InfoSec
BleepingComputerCritical 'HTTP2Shell' Brotli vulnerability triggers emergency patchesA critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.