Critical 'HTTP2Shell' Flaw in Brotli Decoder Prompts Emergency Patches for Node.js

What Happened

BleepingComputer reports a critical vulnerability dubbed "HTTP2Shell" in Brotli, the C decompression library embedded in Node.js. According to the report, the flaw could allow an attacker to corrupt memory and access sensitive data, prompting emergency patches. Further technical details — such as a CVE identifier, affected version ranges, or a CVSS score — were not specified in the source material available at this time.

Why It Matters

Brotli is a widely used compression codec bundled into Node.js and many HTTP stacks, meaning this is a supply-chain-style exposure: any application that decompresses Brotli-encoded content (commonly HTTP response/request bodies) could be a potential attack surface if the vulnerable decoder is reachable with attacker-controlled input. Memory corruption bugs in native decompression libraries are historically serious because they can lead to information disclosure or, in worse cases, remote code execution, and because the library is often several layers removed from application code, making it easy to overlook during patch triage.

What Defenders Should Do Now

• Inventory which Node.js versions and services are in use, and check for emergency patches or advisories from the Node.js project and any vendors bundling Brotli.
• Prioritize patching internet-facing services that decompress untrusted Brotli content (e.g., reverse proxies, API gateways, web servers handling the Content-Encoding: br header).
• Where patching must be staged, consider temporarily disabling Brotli decoding/negotiation on exposed endpoints as a stopgap mitigation.
• Watch for anomalous crashes, segfaults, or unexpected process restarts in Node.js services around the time Brotli-encoded payloads are processed — these can be early indicators of exploitation attempts against a memory-corruption bug.
• Review logging/monitoring for unusual HTTP traffic patterns involving compressed request/response bodies targeting Node.js-based services.

Developing Story

This item is based on an initial news report and details are still emerging; no CVE identifier or technical root-cause analysis was available in the source material at the time of this writing. We will track this story as more information is published. Read the original report at BleepingComputer.