Critical Brotli decoder flaw 'HTTP2Shell' triggers emergency patches across multiple platforms
A critical out-of-bounds write flaw named 'HTTP2Shell' was discovered in Google’s Brotli decoder library used in Node.js, .NET, PowerShell, and Python packages, allowing memory corruption and potential code execution. The vulnerability has prompted emergency patches from Microsoft, Node.js maintainers, and other affected projects. The issue stems from the C decoder library built into these runtimes.
Why it matters: Developers must update their dependencies immediately to prevent remote code execution via the Brotli library.
Read the coverage
More in Security
Security11h ago2 sources
Security11h ago2 sources
Security16h ago2 sources