Emergency patches issued for critical Brotli 'HTTP2Shell' memory corruption flaw
Vulnerability affects Node.js and Chrome-based browsers; updates available
Key Takeaways
- Critical memory corruption vulnerability 'HTTP2Shell' in Brotli C decoder library
- Affects Node.js and Chrome/Chromium-based browsers
- Emergency patches released by Google and Node.js maintainers
- Users should update to Brotli v1.1.9 or Node.js v22.12.0+
- Exploitation status unconfirmed; likely requires crafted HTTP/2 requests
Quick answers
- What happened?
- A critical memory corruption vulnerability in the Brotli C decoder library, tracked under the name 'HTTP2Shell', has prompted emergency patches from Google and Node.js maintainers. The flaw could allow attackers to corrupt memory and access sensitive data via crafted HTTP/2 requests. Users are advised to update to patched versions immediately.
- Which products are affected?
- Brotli, Node.js, Chrome, Chromium-based browsers
- What should defenders do?
- Update Brotli to version 1.1.9 or later, and update Node.js to version 22.12.0 or later. Apply the latest Chrome update from Google. Monitor official security advisories from Google and the Node.js project for CVE assignments and additional details.
A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js and Chrome/Chromium-based browsers, could allow attackers to corrupt memory and access sensitive data. The vulnerability was reported on 2026-10-26 and has triggered emergency patches from Google and the Node.js maintainers. Successful exploitation may lead to remote code execution or sensitive data exposure via crafted HTTP/2 requests that trigger the Brotli decompression path. Google has released an update for Chrome, and Node.js maintainers have published patched versions. Users and administrators are strongly advised to update their software to the latest versions to mitigate the risk. The vulnerability involves memory corruption in the C decoder and its severity and active exploitation status require further verification from official security advisories and CVE assignments.
Security Details
The vulnerability involves memory corruption in the Brotli C decoder library. Exploitation may allow attackers to corrupt memory and access sensitive data via crafted HTTP/2 requests leveraging the Brotli decompression path. Exact attack vectors and severity details are pending official CVE assignment and security advisory release.
Affected products
Brotli, Node.js, Chrome, Chromium-based browsers
Mitigation
Update Brotli to version 1.1.9 or later, and update Node.js to version 22.12.0 or later. Apply the latest Chrome update from Google. Monitor official security advisories from Google and the Node.js project for CVE assignments and additional details.
Sources
BleepingComputer
Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
Oct 26, 2026 · 16:27
Original link
Related Security News
Multiple Critical RCE Vulnerabilities and Supply-Chain Incident Reported in Weekly Recap
A weekly cybersecurity recap highlights the emergence of multiple critical remote code execution vulnerabilities across various platforms, with active scanning and exploitation observed. Additionally, a software supply-chain incident was reported following the leakage of a signing key, raising compromise risks for downstream users.
