Brotli 'Node2Shell' flaw triggers emergency patches across .NET, PHP and Node.js

· Cybersecurity · United States

A critical out-of-bounds write flaw in Google's Brotli decoder library, tracked variously as Node2Shell, HTTP2Shell, Broccoli2Shell and CVE-2026-111497, is forcing emergency patching across major software stacks. The bug can corrupt memory and potentially let attackers execute code or reach sensitive data, and it affects Brotli as built into Node.js, Microsoft .NET and PowerShell, and Python packages; in PHP it is reachable through the cURL extension when decompressing data. Microsoft issued emergency .NET security updates, and the PHP project rebuilt its official Windows packages for PHP 8.2 through 8.5 within five days of a previous Windows fix. Node.js and Python packages are also affected, and the flaw has been added to the ranks of the week's widely scanned remote-code-execution bugs. Security teams face another urgent patch cycle across runtimes and language ecosystems.

Why it matters：Because Brotli is embedded in runtimes and language packages used across web servers, desktop software and industrial products, a single decoder flaw creates simultaneous exposure for a huge share of enterprise infrastructure.

Key points

  • The flaw is an out-of-bounds write in Google's Brotli decoder that can lead to code execution
  • PHP rebuilt Windows packages for versions 8.2–8.5 to address CVE-2026-111497
  • The bug appears under several names: Node2Shell, HTTP2Shell and Broccoli2Shell

Sources (original reporting)

More stories from this day