Brotli decoder flaw spreads across HTTP tools, fixes roll out
10/24/2026 — 10/24, 14:20·2 sources (all)·2 reports (all)
Key takeaways
- Node.js has fixed a high-severity Brotli decoder flaw, CVE-2026-111497, that could allow remote code execution when servers decompress untru…
Latest turnAikido Security reports the former Node2Shell issue now affects HTTP software that decompresses Brotli and renames it HTTP2Shell; it is still a Brotli decoder flaw, not a new CVE. Crafted data can trigger abnormal block switching, causing crashes, memory leaks, or code execution in some cases. Node.js, Bun, Python and Brotli upstream have released fixes.
- Heat index
- 177
- All sources
- 2
- All reports
- 2
- First seen
- 7 hours ago
Reports on this story headlines open the original
Aikido Security reports the former Node2Shell issue now affects HTTP software that decompresses Brotli and renames it HTTP2Shell; it is still a Brotli decoder flaw, not a new CVE. Crafted data can trigger abnormal block switching, causing crashes, memory leaks, or code execution in some cases. Node.js, Bun, Python and Brotli upstream have released fixes.
蓝点网AI score 67Node.js patched high-severity CVE-2026-111497 in its Brotli decoder, where decompressing untrusted data could allow remote code execution. OpenAI Codex Security researchers reported it, and patched builds cover three supported release lines.
DEV Community · AIAI score 64
Other stories people are talking about
- Heat index 1495RisingMoonshot AI releases Kimi K3.1 Pro; open-weight release set for Nov. 419 sources
- Heat index 921RisingOpenAI trains frontier models offline, discloses software flaw12 sources
- Heat index 511RisingOpenAI trims pre-money valuation to $1.25 trillion as $30B funding round nears close9 sources
- Heat index 431Meta creates non-voting Class C shares to fund AI buildout11 sources
- Heat index 391DeepSeek closes around CNY 10B funding round led by CATL and Tencent8 sources
How is heat calculated?About the methodHide
Heat counts how many independent sources covered a story in the last 48 hours: one source counts once no matter how many posts it published, decaying with a 24-hour half-life. What ranks first is what many people are talking about.
This page aggregates public feeds. Headlines and summaries are machine-organized and remain the property of the original authors; verify important facts at the source. If you believe a headline or summary infringes your rights, email the contact address in the footer with the page URL and basis of your claim, and we will remove or replace it after review.
- Surge
- Discussion rising fast
- New
- First report within 6 hours
- Rising
- Still gathering discussion