A critical vulnerability in Google's Brotli compression library (CVE-2026-111497, CVSS 9.2) allows remote code execution via crafted compressed streams. Disclosed October 21 as "Node2Shell," the flaw affects Node.js, Python, C++, bun, Envoy, and other runtimes bundling Brotli versions 1.0.3–1.2.0. OpenAI discovered the issue in February but it wasn't classified as a security vulnerability until now. The bug causes the decoder to accept excess bytes, overflowing a buffer and enabling memory corruption or arbitrary code execution.
Attackers can exploit this bidirectionally — malicious clients can compromise servers, and malicious servers can compromise clients accepting compressed responses. Patches are available for libbrotli 1.2.1, Node.js 22.23.4/24.22.1/26.12.1, Python Brotli 1.2.1 and brotlicffi 1.2.1.0. Apache and Nginx are unaffected by default. Advisory databases don't yet map the CVE to PyPI packages, so automated scanners may miss it. Immediate action required: upgrade Brotli dependencies, rebuild container images, and disable Brotli decoding where patches are unavailable.
Source: Hacker News · Summarized by HeadlinesBriefing