Microsoft and others ship emergency patches for critical Brotli flaw in Node.js

A critical flaw dubbed HTTP2Shell in Brotli, the C decoder library built into Node.js, could let attackers corrupt memory and access sensitive data, potentially enabling remote code execution. Microsoft and other vendors have released emergency patches.

• HTTP2Shell in the C Brotli decoder allows memory corruption and RCE
• Brotli is built into Node.js, widening the exposure
• Microsoft and other vendors have shipped emergency fixes