SecurityWeek

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.
CSO Online

Node2Shell puts Microsoft and Node.js on Brotli patch duty

An out-of-bounds write in Google’s Brotli decoder affects multiple software ecosystems, prompting security updates for .NET, ...
cyberkendra.com

Node2Shell Exploited in the Wild: Node.js Brotli RCE

ELLIO logs the first in-the-wild Node2Shell (CVE-2026-111497) attack — a 23 MB Brotli payload hitting stock Node.js. Patch ...
Help Net Security

Brotli bug reaches far beyond Node.js (CVE-2026-111497)

The Node2Shell vulnerability in Brotli is under active attack. Patch Node.js to 26.12.1, 24.22.1 or 22.23.4 now.
Tech Critter

HTTP2Shell Flaw: Critical Brotli Vulnerability Explained

HTTP2Shell is a critical flaw in Google's Brotli decoder affecting Node.js, Python, Bun and other software. Learn about the ...
The Next Web

Microsoft ships emergency .NET fixes for a critical Brotli flaw

Node.js says the Brotli decoder ‘kept appending input bytes to an eight-byte internal buffer’. Microsoft has now patched .NET ...

Node2Shell flaw embedded in apps and dev tools far beyond Node.js

The recently publicised high severity vulnerability in a popular Google-developed compression library reaches well beyond the ...
Red Hot Cyber

Node.js, scoperta una falla che può aprire le porte agli hacker: è Node2Shell

Proteggi il tuo sistema: aggiorna Node.js per evitare l'esecuzione remota di codice causata dalla vulnerabilità nel decoder ...
合同会社ロケットボーイズ

「HTTP2Shell」CVE-2026-111497、Node.js・Python・Bun・Envoyに影響 Brotliの重大脆弱性と修正版を確認

Brotliの重大脆弱性CVE-2026-111497（HTTP2Shell／Node2Shell）がNode.js、Python、Bun、Envoy、Istioに波及。CVSS、PoC公開状況、修正版、PHP2Shellとの違いを確認し、企業の資産・バージョン把握とアップデート計画を解説 ...

Node2Shell漏洞遍布应用和开发工具，远超Node.js范围

近日公开的一个高危漏洞出现在谷歌开发的流行压缩库中，影响远不止开源的Node.js JavaScript运行时，澳大利亚安全研究员发现了这一点。 OpenSourceMalware的联合创始人兼首席技术官Paul McCarty对多个软件生态系统中的开发者工具和库进行了调查，这些生态系统实现或集成了谷歌的Brotli解压缩，以寻找对底层漏洞的暴露情况。 他确认了一系列可能受影响的软件，涵盖了多个常 ...