GoKawiilBrotli decoder flaw CVE-2026-111497 prompts Microsoft emergency patch
A critical buffer overflow in the Brotli compression library, affecting versions 1.0.3-1.0.9, 1.1.0 and 1.2.0, can let attackers craft malicious compressed streams that corrupt memory on vulnerable decoders. The bug, nicknamed HTTP2Shell, Broccoli2Shell or Node2Shell, originated in Node.js but also touches Python libraries like urllib3, requests, httpx and aiohttp, prompting Microsoft to ship an emergency .NET update on Sunday.
GoKawiil's interpretation of the reporting above, not reported fact.
Because Brotli is embedded across many language ecosystems rather than tied to one framework, the flaw's reach extends well beyond Node.js to any service decompressing attacker-controlled data, which could widen the pool of exploitable targets. Microsoft's warning that exploitation enables privilege escalation suggests the risk is not limited to data exposure but could allow deeper system compromise on unpatched .NET installations.
- CVE-2026-111497 is a buffer overflow in Brotli versions 1.0.3-1.0.9, 1.1.0 and 1.2.0.
- Affected software spans Node.js, .NET, and Python libraries like urllib3, requests, httpx and aiohttp.
- Microsoft already issued an emergency .NET patch, citing risk of privilege escalation.
Source: bleepingcomputer.com, 2026-10-26
Published there as: “Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.