Vendors issue emergency patches for critical Brotli remote code execution flaw
A critical vulnerability in the Brotli compression library discovered by OpenAI researchers has prompted emergency patches across Node.js, Microsoft, and Python packages.
OpenAI's security team has uncovered a critical flaw in the widely used Brotli compression library, tracked as CVE-2026-111497. Dubbed "HTTP2Shell"—and also referred to as "Node2Shell" by SecurityWeek—the vulnerability can trigger memory corruption, expose sensitive data, or allow unauthenticated remote code execution when an application decompresses malicious Brotli data.[1][3][5][6][7][8]
The bug presents risks across multiple environments that integrate Brotli, including Node.js, Bun, and Envoy. Exploitation requires no login credentials and functions in both directions, meaning an attacker could compromise an unpatched server or a malicious server could hijack an unpatched client device.[1][4]
The disclosure has spurred rapid remediation across the software ecosystem, with BleepingComputer reporting emergency fixes from Microsoft alongside updates for Node.js and Python packages. Node.js released initial fixes on October 21, and users are urged to review bundled dependencies and upgrade to Brotli 1.2.1 or their vendor's patched versions.[1][2][3][5][6]
Key facts
- OpenAI's security team identified a critical unauthenticated remote code execution vulnerability in the Brotli compression library, tracked as CVE-2026-111497.
- The vulnerability is dubbed 'HTTP2Shell' and referred to as 'Node2Shell' by SecurityWeek.
- The bug allows attackers to corrupt memory, expose sensitive data, or crash applications without authentication when malicious Brotli data is decompressed.
- The issue impacts software including Node.js, Bun, and Envoy, and can be exploited against unpatched servers or client devices without requiring authentication.
- Node.js issued patches for the flaw on October 21, 2026.
- Emergency patching has expanded to Microsoft, Node.js, and Python packages, with recommendations to upgrade to Brotli 1.2.1 or relevant vendor releases.
Sources · 8 sources
- CB
Coin Bureau@coinbureauPost on X ·
⚠️ ALERT: “HTTP2Shell” raises fresh concerns after the PHP warnings leaving Google’s Brotli compression library potentially vulnerable. Discovered by OpenAI’s security team, CVE-2026-111497 affects software that decompresses malicious Brotli data, with risks extending beyond Node.js and Python. The flaw can cause crashes, expose sensitive memory or potentially enable remote code execution BEFORE authentication in affected setups. Researchers have demonstrated code execution in a vulnerable Node.js application. Fixes are available, but not for every affected package. Users are urged to check bundled dependencies and upgrade to Brotli 1.2.1 or your vendor’s patched release.
Open source - TE
Techmeme@TechmemePost on X ·
Microsoft and others push out emergency patches for a critical flaw in Brotli, the C decoder library built into Node․js, that could allow remote code execution (@billtoulas / BleepingComputer) (Visit Techmeme dot com for the link and full context!)
Open source - TE
TechmemeArticle ·
Microsoft and others push out emergency patches for a critical flaw in Brotli, the C decoder library built into Node.js, that could allow remote code execution (Bill Toulas/BleepingComputer) Bill Toulas / BleepingComputer : Microsoft and others push out emergency patches for a critical flaw in Brotli, the C decoder library built into Node.js, that could allow remote code execution — A critical flaw dubbed ‘HTTP2Shell’ in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.
Open source - UW
unusual_whales@unusual_whalesPost on X ·
BREAKING: OpenAI says it found a critical flaw in Brotli, a widely used compression library built into software like Node.js, Bun and Envoy. The bug could let an attacker take over a system just by sending it malicious compressed data, with no login needed. That works both ways: a hacker could hijack an unpatched server, or a malicious server could hijack an unpatched user’s device.
Open source - SE
SecurityWeek@SecurityWeekPost on X ·
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages https://t.co/ryRLsGaJOw
Open source - R�
RuntimeWire 🏴☠️@runtimewirePost on X ·
OpenAI researchers found a remote-code-execution flaw in Brotli, prompting runtime patches. Node.js pushed fixes on October 21st and the bug is tracked as CVE-2026-111497. If your app decompresses attacker-controlled Brotli data it could be crashed or remotely exploited; patch Node.js and other runtimes now. https://t.co/4g5b7ZQ51D
Open source - 阳明
阳明AI@x_autonomyPost on X ·
【AI热点】06:00-12:00 更多详细信息→https://t.co/2HzGIwf2fu 1. OpenAI红队测试发现Brotli未认证远程代码执行漏洞并已披露 [影响大·可执行中] 2. OpenAI断网训练前沿模型智能体仍能用CPU缓存时序通信 [影响大·可执行低] 3. 月之暗面发布Kimi K3.1 Pro 3T级开源权重模型 [影响大·可执行中]
Open source - CB
Crypto BriefingArticle ·
OpenAI uncovers remote code execution flaw in Brotli compression library The discovery highlights the critical need for proactive security measures and timely updates in widely-used open-source software libraries. The post OpenAI uncovers remote code execution flaw in Brotli compression library appeared first on Crypto Briefing .
Open source