Critical HTTP2Shell Flaw Threatens Millions of Servers Across Node.js and .NET

Major technology companies and open-source projects are racing to secure systems against a critical data compression flaw dubbed HTTP2Shell. Tracked as CVE-2026-111497 with a maximum severity score of 9.2, the out-of-bounds write vulnerability targets Brotli, an open-source compression algorithm originally developed by Google to accelerate web transmission times for assets like HTML, CSS, and JavaScript.

The flaw stems from an invalid block switch misinterpretation in the streaming decoder, allowing an attacker who supplies malicious Brotli data to corrupt process memory. This buffer overflow can cause application crashes, memory disclosure, denial of service, and potentially remote code execution. Because Brotli is deeply embedded across modern infrastructure, the bug impacts a massive array of software packages, including Python libraries, .NET applications, and multiple versions of Node.js.

Google issued updated Brotli versions 1.0.10, 1.1.1, and 1.2.1 to neutralize the underlying issue. Following this, Microsoft deployed an emergency patch for .NET environments to prevent potential privilege escalation risks, while Node.js released updates addressing vulnerable versions in its 22.x, 24.x, and 26.x branches. Python ecosystem maintainers similarly published patched PyPI packages for brotli and brotlicffi.

Although a public proof-of-concept exploit surfaced shortly after the disclosure, security trackers report no confirmed malicious exploitation in the wild yet. System administrators are urged to apply vendor patches immediately, restart affected processes, and rebuild container images. For environments unable to patch instantly, mitigation steps include adjusting proxies or web application firewalls to filter incoming Brotli-compressed traffic.