search
HTTP2Shell
Trends
- 1
Microsoft has released out-of-band updates fixing four vulnerabilities in .NET, including a Brotli compression flaw and the 'HTTP2Shell' vulnerability affecting PowerShell, after a botched regular Patch Tuesday. Node.js has also shipped security updates across versions 22, 24 and 26, fixing ten vulnerabilities in total. Reports warn millions of sites could be at risk, drawing comparisons to a recent critical PHP vulnerability, prompting sysadmins to patch urgently.
- 2
A newly disclosed vulnerability, tracked as CVE-2026-111497 and dubbed 'HTTP2Shell', affects .NET and related runtimes, allowing potential remote code execution via HTTP/2. Microsoft has issued emergency updates covering PowerShell and other components, while Node.js has shipped patched releases 22.23.4, 24.22.1 and 26.12.1, fixing ten vulnerabilities in total. Administrators are being urged to patch immediately.
- 3http2shell remote code execution hits Node, Python runtimes▼Evolving Threat: http2shell is an RCE in Node, Python, and more
Security researchers are flagging http2shell, a remote code execution vulnerability that affects not just one language but several major runtimes including Node.js and Python. The flaw is being described as an evolving threat because exploitation techniques keep adapting, and developers across ecosystems are being urged to check whether their deployments are exposed and patch promptly.
- 4Node2Shell vulnerability evolves into HTTP2Shell threat●Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
Security researchers report that the Node2Shell vulnerability class has evolved into HTTP2Shell, extending the impact to a wide range of HTTP libraries and applications rather than only Node.js packages. The development raises concerns about how many projects may be exposed, with Python packages such as Brotli cited in connection with the flaw.
- 5Security flaws reported in Brotli decoder libraries●Brotli Decoder Vulnerabilities (Node2Shell, Broccoli2Shell, HTTP2Shell)
Newly disclosed vulnerabilities in Brotli decoder implementations have been given names including Node2Shell, Broccoli2Shell and HTTP2Shell, suggesting the flaws could allow attackers to achieve remote code execution in environments that parse Brotli-compressed data. Brotli is a compression format widely used across web servers, browsers and developer tooling, so affected libraries are broadly deployed. Esri has published an advisory referencing the issues, and security teams are checking whether their products embed vulnerable decoder code.
- 6Node.js, Bun and Python rush out fixes for HTTP2Shell flaw●Kürzlich ein System-Update gemacht? Node.js, Bun und Python bringen für HTTP2Shell (CVE-2026-111497) ihre eigene Brotli-
Developers are being urged to check their systems after a vulnerability tracked as CVE-2026-111497, dubbed HTTP2Shell, was addressed in new releases of Node.js, Bun and Python. The runtimes ship their own bundled copy of the Brotli compression library, so simply upgrading the system package libbrotli1 on Debian or Ubuntu is not enough. Users are advised to update to Node.js 22.23.4, 24.22.1 or 26.12.1, Bun 1.4.4, or the Brotli Python package 1.2.1 or later.