Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites

A critical vulnerability dubbed HTTP2Shell has been discovered in Brotli, an open-source compression algorithm used by numerous software applications. This flaw could potentially lead to memory corruption and remote code execution, posing a significant threat to systems worldwide. The vulnerability, tracked as CVE-2026-111497, has an extremely high severity rating of 9.2/10.

Major tech companies and projects have swiftly released patches for the issue. Microsoft released an emergency update for .NET, while Node.js issued a patch for its affected versions. Google also addressed the issue by releasing updated versions of Brotli (1.0.10, 1.1.1, and 1.2.1) on October 21, 2026.

However, the risk persists as some software may still be using vulnerable Brotli versions, either as standalone components or bundled within other applications. In such cases, updating the underlying library alone may not suffice. For instance, apps utilizing Node.js or Python packages containing the affected Brotli libraries remain exposed.

System administrators are strongly advised to apply the available patches promptly, restart affected processes, and rebuild and redeploy any impacted container images. Mitigation techniques, such as using proxies, load balancers, or web application firewalls to block malicious Brotli-compressed requests, can also help minimize the potential impact.

Despite the existence of proof-of-concept exploits, there have been no reports of actual malicious exploitation in the wild, yet the threat remains significant and warrants immediate attention.