Brotli flaw behind Node2Shell spreads: Microsoft rushes .NET patches, Python affected

A serious security flaw in Brotli, Google's widely used data-compression library, has turned out to affect far more software than Node.js, where it was first reported as "Node2Shell". Microsoft released emergency out-of-band updates for .NET on Sunday, October 25, 2026, because .NET uses its own copy of the Brotli decoder, and security researchers have confirmed that Python packages and the Envoy and Istio networking tools are also affected when Brotli decompression is switched on. Japan's computer emergency response team, JPCERT/CC, and its IT agency IPA issued an advisory on October 26. The flaw, tracked as CVE-2026-111497, is now also being called "HTTP2Shell", although it is a bug in the Brotli decoder, not in the HTTP/2 web protocol.

Brotli is a compression format that makes web pages and files smaller so they load faster. Browsers and servers use it all the time, which is why a flaw in its decoder, the part that unpacks compressed data, has spread across so many products. When software unpacks data sent by a stranger on the internet, a bug in that step can let a carefully crafted file overwrite memory it should not touch, and in the worst case let the attacker take control.

The new names reflect how far the problem reaches. It is not one product's bug but a shared component used inside web servers, application frameworks and cloud networking tools. Companies that patched only Node.js last week may still be exposed through .NET applications, Python services or Envoy proxies. Security teams therefore need to search their whole software stack, including libraries bundled inside other software, rather than fix a single product.

For India's start-ups and IT services companies, which run large numbers of web applications on Node.js, Python and .NET, the practical task is an audit. Teams should list every service that accepts Brotli-compressed data, update the runtime or library to a fixed version, and replace end-of-life versions of Node.js that will never be patched. Where an immediate update is not possible, researchers suggest rejecting Brotli-compressed request bodies at the network edge and switching off automatic decompression in services that fetch content from addresses an attacker could choose.

Short-term: Organisations running affected software must patch quickly, since detailed write-ups of the bug are now public. Cloud and hosting providers are pushing updates, but applications that bundle their own copies of Brotli may need separate fixes.

Long-term: The episode is another reminder of the risk in widely shared open-source components, where one bug can ripple through thousands of products, and of the cost of running software versions that no longer receive security updates.

Who is affected: Developers and security teams using Node.js, .NET, Python, Bun, Envoy or Istio; start-ups and enterprises running web services; and cloud providers.

Questions and Answers