Security1 hOctober 29, 2026, 10:53

HTTP2Shell: Brotli decoder buffer overflow threatens production servers

A vulnerability dubbed HTTP2Shell (CVE-2026-111497) in the native Brotli decoder causes an out-of-bounds write when processing crafted compressed input. It can lead to crashes, data exposure or remote code execution in Node.js, Python, .NET, Docker images and Kubernetes workloads; fixes ship in Node.js 22.23.4, 24.22.1 and 26.12.1.

DEV Community

Open source

HTTP2Shell: Brotli decoder buffer overflow threatens production servers

CVE-2026-111497 is an out-of-bounds write in the native Brotli decoder
Fixed Node.js releases: 22.23.4, 24.22.1 and 26.12.1
Docker images, Kubernetes workloads and bundled Brotli decoders are at risk
Temporary mitigation: disable Brotli decompression of untrusted input

#Brotli#Node.js#Kubernetes#Docker

HTTP2Shell: critical Brotli decoder flaw CVE-2026-111497

Security

Juniper Junos OS BGP daemon buffer overflow rated 9.8

Security

Microsoft ships out-of-band .NET patches for critical buffer overflow flaws

Security

HTTP2Shell: Brotli decoder buffer overflow threatens production servers

HTTP2Shell: critical Brotli decoder flaw CVE-2026-111497

Juniper Junos OS BGP daemon buffer overflow rated 9.8

Microsoft ships out-of-band .NET patches for critical buffer overflow flaws

Apache httpd patch fixes mod_vhost_alias stack buffer overflow