{
  "id": 16359728,
  "title": "Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps",
  "url": "https://urgent.news/2026/10/24/node2shell-evolves-to-http2shell-blast-radius-affects-many-http-libs-16359728",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-24T08:06:39.000Z",
  "source": {
    "name": "Hacker News Best",
    "slug": "hacker-news-best",
    "url": "https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497"
  },
  "original_language": "en",
  "account": "Node2Shell has evolved into HTTP2Shell, affecting numerous HTTP libraries and applications due to a critical out-of-bounds write vulnerability in the Google Brotli decoder. This flaw, CVE-2026-111497, impacts versions 1.0.3 through 1.2.0 across all platforms. An attacker can exploit this by sending a specially crafted Brotli-compressed stream, leading to memory corruption, sensitive data leakage, process crashes, or potential arbitrary code execution. The vulnerability carries a CVSS v4.0 score of 9.2, classified as critical.\n\nThe Brotli algorithm, developed by Google, is a lossless compression method used for data storage and transmission over the internet, commonly employed in web content such as HTML, CSS, and JavaScript. The root cause of the issue was initially identified in February but was not recognized as a security concern until recently. The vulnerability affects the Brotli decoder in Node.js, Python packages Brotli and brotlicffi, and other compatible software.\n\nAlthough the upstream fix was implemented in February, it took time for vendors to release updated versions. As a result, any software utilizing Brotli 1.2.0 or earlier, or brotlicffi 1.2.0.x is at risk. Popular HTTP clients like requests, httpx, and aiohttp automatically load these packages, leaving them vulnerable unless updated. It is crucial to upgrade to Brotli 1.2.1 or brotlicffi 1.2.1.0 and rebuild affected container images to mitigate the risk.\n\nDespite the availability of updated libraries, some advisory databases still fail to map the CVE to PyPI packages, making it challenging for automated tools to identify vulnerable versions. Users are advised to manually check their dependencies, rebuild their applications, and redeploy services to ensure they are protected against this vulnerability. Continuous monitoring and verification of patched components are essential to maintain the security of affected systems.",
  "summary": "Article URL: https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497 Comments URL: https://news.ycombinator.com/item?id=50219177 Points: 221 # Comments: 101",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Dev.to",
        "title": "HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure",
        "url": "https://urgent.news/2026/10/25/http2shell-cve-2026-111497-wordpress-and-next-js-exposure",
        "published": "2026-10-25T23:22:51.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}