Nodejs
Latest stories covering Nodejs, with summaries and links to related coverage.
1 stories · 1 reports · page 1 of 1
The topic overview is temporarily unavailable. You can still browse coverage below.
Connected topics are temporarily unavailable. You can still browse stories below.
Latest stories
Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
news
12 min read
CVE-2026-111497, also called Node2Shell and HTTP2Shell, is a critical out-of-bounds write in Google’s Brotli decoder affecting versions 1.0.3 through 1.2.0 on all platforms. A remote unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt process memory, expose sensitive data, crash software, or potentially execute code. The flaw has a CVSS v4.0 score of 9.2 and can affect both servers that decode Brotli-compressed requests and clients that automatically decode Brotli-compressed responses. OpenAI said it discovered the issue in February; the underlying source fix was not initially recognized as a security vulnerability. Brotli is widely used for HTTP compression, extending exposure beyond Node.js to Python packages, HTTP clients, proxies, gateways, and applications that bundle the decoder. Python environments using Brotli 1.2.0 or earlier or brotlicffi 1.2.0.x are affected, including when urllib3, requests, httpx, aiohttp, or Scrapy load those packages automatically. Fixed releases include Brotli 1.2.1, brotlicffi 1.2.1.0, Node.js 22.23.4, 24.22.1, or 26.12.1, Bun 1.4.4, and specified Envoy and Istio updates. Organizations should update dependencies, rebuild images and bundled applications, redeploy services, and verify running versions. Until patching is possible, disabling Brotli decoding, rejecting incoming Content-Encoding: br requests, and preventing response decoding can reduce exposure.