[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$fu8npoxu0lvr1":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":61,"author":76,"related":78},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[63,66],{"key":64,"label":65},"advisories","Advisories",{"key":67,"label":68},"security","Security",6,"\u003Cp>A LinkedIn card shouting \"URGENT: HTTP2Shell, RCE across the HTTP stack, PATCH NOW\" landed in my feed today, so I went to the primary sources before writing anything. Short version: the bug is real, it is serious, and you should patch. But it is a bug in one library, the Brotli decoder, and whether it can hurt you depends on one question: does your software decompress Brotli data that someone else controls?\u003C\u002Fp>\u003Ch2 id=\"what-it-actually-is\">What it actually is\u003C\u002Fh2>\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-111497&ref=ghost.jdneer.com\">CVE-2026-111497\u003C\u002Fa> was assigned by Google, which is the CNA for Brotli. The record is titled \"Out-of-Bounds Write in Google Brotli Decoder\" and covers \u003Ccode>c\u002Fdec\u002Fdecode.c\u003C\u002Fcode> in Brotli 1.0.3 through 1.2.0. In the record's words, the flaw \"allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code\" using a crafted Brotli-compressed stream. It is classed as CWE-787 (out-of-bounds write) and CWE-252 (unchecked return value).\u003C\u002Fp>\u003Cp>The \u003Ca href=\"https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases?ref=ghost.jdneer.com\">Node.js advisory\u003C\u002Fa> explains the mechanics: an invalid block switch inside the stream was reported as \"need more input\" instead of a format error, so the streaming decoder kept appending bytes to an eight-byte internal buffer. The finders credited by both Google and Node.js are Khai Tran and Sylvie Mayer of OpenAI Codex Security.\u003C\u002Fp>\u003Cp>\"HTTP2Shell\" is a nickname from security vendors, not the official name. You will also see Node2Shell, Brotli2Shell and Broccoli2Shell for the same CVE.\u003C\u002Fp>\u003Ch2 id=\"how-bad-is-it\">How bad is it?\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>Score:\u003C\u002Fstrong> Google, as the CNA, rates it 9.2 Critical (CVSS 4.0, with \"attack requirements: present\"). Node.js rates it High. \u003Ca href=\"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-111497?ref=ghost.jdneer.com\">Red Hat\u003C\u002Fa> rates it Important at 8.1 (CVSS 3.1) and the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fannouncements\u002Fissues\u002F494?ref=ghost.jdneer.com\">.NET advisory\u003C\u002Fa> also uses 8.1 High.\u003C\u002Fli>\u003Cli>\u003Cstrong>Remote code execution:\u003C\u002Fstrong> Demonstrated, but narrowly. \u003Ca href=\"https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fnode2shell-from-brotli-data-to-remote-code-execution\u002F?ref=ghost.jdneer.com\">Imperva\u003C\u002Fa> ran attacker-supplied code on the official Node.js 24.22.0 Linux arm64 image, through both \u003Ccode>fetch()\u003C\u002Fcode> and Express 5 body parsing. It took several attempts, and the same input was rejected by 24.22.1. Nobody has shown reliable code execution across every platform and product.\u003C\u002Fli>\u003Cli>\u003Cstrong>Exploitation in the wild:\u003C\u002Fstrong> None reported. It is not in the \u003Ca href=\"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?ref=ghost.jdneer.com\">CISA KEV catalog\u003C\u002Fa>, and CISA's enrichment on the CVE record lists exploitation as \"none\".\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"what-across-the-http-stack-really-means\">What \"across the HTTP stack\" really means\u003C\u002Fh2>\u003Cp>The bug is not in HTTP, HTTP\u002F2 or any web server's own code. It is in a shared C library, so anything that bundles or links an affected Brotli decoder inherits it. As Jan Schaumann put it on \u003Ca href=\"https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F10\u002F23\u002F25?ref=ghost.jdneer.com\">oss-security\u003C\u002Fa>, don't look at the Node.js advisory and think \"I don't use Node.js, so nothing to worry about.\"\u003C\u002Fp>\u003Cp>Attacker data reaches the decoder three ways: a client sends a request body with \u003Ccode>Content-Encoding: br\u003C\u002Fcode> that your app or proxy inflates, your app fetches a URL and the server answers with a Brotli body that your HTTP client decodes automatically, or your code decompresses uploaded or stored data directly. The second path is the sneaky one, because a malicious server can send Brotli even if you didn't ask for it.\u003C\u002Fp>\u003Cp>Plenty of software does none of this by default. The .NET advisory, for example, says ASP.NET Core and HttpClient don't decompress Brotli unless you enable it, and Envoy says only deployments with the Brotli decompressor configured are affected.\u003C\u002Fp>\u003Ch2 id=\"affected-and-fixed-versions\">Affected and fixed versions\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>Google Brotli (libbrotli):\u003C\u002Fstrong> 1.0.3 through 1.2.0 affected. Fixed in \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fbrotli\u002Freleases\u002Ftag\u002Fv1.2.1?ref=ghost.jdneer.com\">1.2.1\u003C\u002Fa>, 1.1.1 and 1.0.10.\u003C\u002Fli>\u003Cli>\u003Cstrong>Node.js:\u003C\u002Fstrong> 22.x, 24.x and 26.x fixed in 22.23.4, 24.22.1 and 26.12.1 (\u003Ca href=\"https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases?ref=ghost.jdneer.com\">Node.js, Oct 21\u003C\u002Fa>). End-of-life lines such as 20.x get no fix.\u003C\u002Fli>\u003Cli>\u003Cstrong>Bun:\u003C\u002Fstrong> 1.0.21 through 1.4.3 affected, fixed in 1.4.4. Rebuild anything made with \u003Ccode>bun build --compile\u003C\u002Fcode> (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Foven-sh\u002Fbun\u002Fsecurity\u002Fadvisories\u002FGHSA-663w-cv8g-jj2p?ref=ghost.jdneer.com\">Bun advisory\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Python:\u003C\u002Fstrong> PyPI \u003Ccode>brotli\u003C\u002Fcode> fixed in 1.2.1 and \u003Ccode>brotlicffi\u003C\u002Fcode> in 1.2.1.0 (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9v8h-qqgm-4m35?ref=ghost.jdneer.com\">GHSA-9v8h-qqgm-4m35\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Envoy:\u003C\u002Fstrong> fixed in 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12, when the Brotli decompressor is configured (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fenvoyproxy\u002Fenvoy\u002Fsecurity\u002Fadvisories\u002FGHSA-3wvj-j6qm-62mr?ref=ghost.jdneer.com\">Envoy advisory\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>.NET:\u003C\u002Fstrong> fixed in runtime 8.0.33, 9.0.22 and 10.0.14. Self-contained and NativeAOT apps must be republished (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fannouncements\u002Fissues\u002F494?ref=ghost.jdneer.com\">.NET advisory\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Debian:\u003C\u002Fstrong> bookworm fixed in 1.0.9-2+deb12u1 (DLA-4855-1), trixie in 1.1.0-2+deb13u1 (DSA-6582-1), sid in 1.2.0-4.1. Forky was still listed as vulnerable when I checked (\u003Ca href=\"https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FCVE-2026-111497?ref=ghost.jdneer.com\">Debian tracker\u003C\u002Fa>). Debian's own \u003Ccode>nodejs\u003C\u002Fcode> packages are tracked separately from brotli and were also listed as vulnerable in bookworm and trixie.\u003C\u002Fli>\u003Cli>\u003Cstrong>Ubuntu:\u003C\u002Fstrong> the brotli package was still \"Needs evaluation\" on all releases when I checked. Ubuntu notes that nodejs on 22.04 and later uses the system brotli, while 20.04's nodejs bundles its own copy and is marked vulnerable (\u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2026-111497?ref=ghost.jdneer.com\">Ubuntu CVE page\u003C\u002Fa>).\u003C\u002Fli>\u003Cli>\u003Cstrong>Red Hat:\u003C\u002Fstrong> track package status on the \u003Ca href=\"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-111497?ref=ghost.jdneer.com\">Red Hat CVE page\u003C\u002Fa>.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Distros backport fixes, so a package can say 1.0.9 or 1.1.0 and still be patched. Trust the distro's fixed package version, not the upstream number.\u003C\u002Fp>\u003Ch2 id=\"how-to-check-your-systems\">How to check your systems\u003C\u002Fh2>\u003Cp>Node.js bundles its own copy of Brotli in the official builds, so check the runtime version and the bundled Brotli:\u003C\u002Fp>\u003Cpre>\u003Ccode>[root@server ~]# node --version\n[root@server ~]# node -p \"process.versions.brotli\"\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>System library, by package manager:\u003C\u002Fp>\u003Cpre>\u003Ccode>[root@server ~]# dpkg -l | grep -i brotli\n[root@server ~]# rpm -qa | grep -i brotli\n[root@server ~]# apk info -v | grep -i brotli\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Python packages, which HTTP clients like urllib3 pick up automatically when installed:\u003C\u002Fp>\u003Cpre>\u003Ccode>[root@server ~]# pip show brotli brotlicffi\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Does your curl decode Brotli at all?\u003C\u002Fp>\u003Cpre>\u003Ccode>[root@server ~]# curl -V | grep -io brotli\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Which running processes still have the system's shared decoder library loaded. This only finds processes using your distro's libbrotlidec, so official Node.js builds, Bun and static binaries, which carry their own copy, won't show up. An empty result is not an all clear:\u003C\u002Fp>\u003Cpre>\u003Ccode>[root@server ~]# grep -l brotlidec \u002Fproc\u002F*\u002Fmaps 2>\u002Fdev\u002Fnull\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Don't forget container images, CI runners and anything statically linked. Those carry their own copy.\u003C\u002Fp>\u003Ch2 id=\"what-to-do\">What to do\u003C\u002Fh2>\u003Col>\u003Cli>\u003Cstrong>Patch\u003C\u002Fstrong> the runtime or library: Node.js, Bun, Python packages, .NET, Envoy, and your distro's brotli package.\u003C\u002Fli>\u003Cli>\u003Cstrong>Restart\u003C\u002Fstrong> every process that loaded the decoder. Updating the package does not fix a running process.\u003C\u002Fli>\u003Cli>\u003Cstrong>Rebuild\u003C\u002Fstrong> container images on a patched base, redeploy, and bump the pins in your lockfiles so the next build doesn't pull the old version back in.\u003C\u002Fli>\u003Cli>\u003Cstrong>Prioritize\u003C\u002Fstrong> services that accept \u003Ccode>Content-Encoding: br\u003C\u002Fcode> bodies or fetch URLs you don't control, like webhooks, link previews and crawlers.\u003C\u002Fli>\u003C\u002Fol>\u003Ch2 id=\"if-you-cant-patch-today\">If you can't patch today\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>Inbound:\u003C\u002Fstrong> reject Brotli request bodies at the reverse proxy before any decoder sees them. In nginx, for example, add this inside your \u003Ccode>server\u003C\u002Fcode> block, then test and reload:\u003C\u002Fli>\u003C\u002Ful>\u003Cpre>\u003Ccode>if ($http_content_encoding ~* \"(^|,)\\s*br\\s*(,|$)\") {\n    return 415;\n}\u003C\u002Fcode>\u003C\u002Fpre>\u003Cpre>\u003Ccode>[root@proxy ~]# nginx -t && systemctl reload nginx\u003C\u002Fcode>\u003C\u002Fpre>\u003Cul>\u003Cli>\u003Cstrong>Outbound:\u003C\u002Fstrong> removing \u003Ccode>br\u003C\u002Fcode> from \u003Ccode>Accept-Encoding\u003C\u002Fcode> is not enough, because a malicious server can send Brotli anyway, and a WAF never sees responses your app fetches. Only the upgrade covers this path.\u003C\u002Fli>\u003Cli>\u003Cstrong>.NET:\u003C\u002Fstrong> remove the \u003Ccode>br\u003C\u002Fcode> provider from request decompression and drop \u003Ccode>DecompressionMethods.Brotli\u003C\u002Fcode> from HttpClient, but only if you already enabled them, as the .NET advisory explains.\u003C\u002Fli>\u003Cli>\u003Cstrong>Bun:\u003C\u002Fstrong> pass \u003Ccode>decompress: false\u003C\u002Fcode> to \u003Ccode>fetch\u003C\u002Fcode> for untrusted servers, per the Bun advisory.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Node.js has published no workaround. For Node.js, upgrading is the fix.\u003C\u002Fp>\u003Ch2 id=\"what-the-linkedin-card-got-wrong\">What the LinkedIn card got wrong\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>\"RCE across the HTTP stack\"\u003C\u002Fstrong> overstates it. The record says \"potentially execute arbitrary code\". Code execution has been shown on one Node.js build and setup, not across every HTTP product, and many servers don't decode Brotli request bodies by default.\u003C\u002Fli>\u003Cli>\u003Cstrong>It isn't only HTTP.\u003C\u002Fstrong> Anything that decompresses untrusted Brotli data is in scope, including files and archives.\u003C\u002Fli>\u003Cli>\u003Cstrong>\"URGENT\"\u003C\u002Fstrong> is fair for patching, but there is no reported exploitation and no KEV listing. Patch on your normal emergency schedule, not in a panic.\u003C\u002Fli>\u003Cli>\u003Cstrong>\"HTTP2Shell\"\u003C\u002Fstrong> is a nickname. Search for the CVE number when you look for vendor advisories.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2 id=\"my-take\">My take\u003C\u002Fh2>\u003Cp>This one is a big deal because of where Brotli lives, not because of a clever exploit. The library sits inside runtimes, proxies, HTTP clients and archive tools, and many of them pull it in without you ever choosing it. Patch, restart, rebuild your images, and spend ten minutes finding where Brotli decoding happens in your stack. The answer will be useful long after this CVE.\u003C\u002Fp>\u003Cp>\u003Cem>Sources: \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-111497&ref=ghost.jdneer.com\">\u003Cem>CVE.org record CVE-2026-111497\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Foctober-2026-security-releases?ref=ghost.jdneer.com\">\u003Cem>Node.js October 2026 security releases\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fbrotli\u002Freleases\u002Ftag\u002Fv1.2.1?ref=ghost.jdneer.com\">\u003Cem>google\u002Fbrotli v1.2.1 release\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9v8h-qqgm-4m35?ref=ghost.jdneer.com\">\u003Cem>GitHub advisory GHSA-9v8h-qqgm-4m35\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Foven-sh\u002Fbun\u002Fsecurity\u002Fadvisories\u002FGHSA-663w-cv8g-jj2p?ref=ghost.jdneer.com\">\u003Cem>Bun GHSA-663w-cv8g-jj2p\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fenvoyproxy\u002Fenvoy\u002Fsecurity\u002Fadvisories\u002FGHSA-3wvj-j6qm-62mr?ref=ghost.jdneer.com\">\u003Cem>Envoy GHSA-3wvj-j6qm-62mr\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fdotnet\u002Fannouncements\u002Fissues\u002F494?ref=ghost.jdneer.com\">\u003Cem>.NET advisory\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fnode2shell-from-brotli-data-to-remote-code-execution\u002F?ref=ghost.jdneer.com\">\u003Cem>Imperva research\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fsecurity-tracker.debian.org\u002Ftracker\u002FCVE-2026-111497?ref=ghost.jdneer.com\">\u003Cem>Debian security tracker\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2026-111497?ref=ghost.jdneer.com\">\u003Cem>Ubuntu CVE page\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-111497?ref=ghost.jdneer.com\">\u003Cem>Red Hat CVE page\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F10\u002F23\u002F25?ref=ghost.jdneer.com\">\u003Cem>oss-security post\u003C\u002Fem>\u003C\u002Fa>\u003Cem>; \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?ref=ghost.jdneer.com\">\u003Cem>CISA KEV catalog\u003C\u002Fem>\u003C\u002Fa>\u003Cem>.\u003C\u002Fem>\u003C\u002Fp>","CVE-2026-111497 (HTTP2Shell): Brotli decoder out-of-bounds write. Affected and fixed versions, how to check, and what to do if you cannot patch yet.",{"src":60,"width":73,"height":74,"type":75},1600,900,"image\u002Fpng",{"name":77,"url":10,"owner":5},"JD Bungart",[79,91,102,111],{"slug":80,"title":81,"excerpt":82,"image":83,"publishedAt":84,"topics":85,"readMinutes":90},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[86,89],{"key":87,"label":88},"guides","Guides",{"key":67,"label":68},1,{"slug":92,"title":93,"excerpt":94,"image":95,"publishedAt":96,"topics":97,"readMinutes":90},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[98,101],{"key":99,"label":100},"opinion","Opinion",{"key":67,"label":68},{"slug":103,"title":104,"excerpt":105,"image":106,"publishedAt":107,"topics":108,"readMinutes":90},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[109,110],{"key":99,"label":100},{"key":67,"label":68},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":90},"insider-threat-lab-poisoning-cases","The Threat Was Already Badged In: Insider Lessons From Two Lab Poisoning Cases","A Wyoming grad student is accused of poisoning an officemate, and the internet already called it espionage. The charge says assault. What the court record actually shows, and the access, procurement, and reporting controls that would have caught it sooner.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Finsider-night-office-brunobd-unsplash.jpg","2026-10-25T14:00:00.000+08:00",[118,119],{"key":99,"label":100},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]