Brotli (HTTP2Shell)
A flaw in Brotli, the compression library inside Node.js, Python packages and many other tools, lets specially crafted compressed data run code. A malicious server can take over a tool that downloads from it, and a malicious client can take over a server.
- On a Mac
- Matters for Node.js, Python's Brotli packages, and Homebrew's Brotli library, which Homebrew's curl uses.
- The fix
- Brotli 1.0.10, 1.1.1 and 1.2.1
- Node.js 22.23.4, 24.22.1 and 26.12.1
- Python Brotli 1.2.1
- Python brotlicffi 1.2.1.0
- CVE
- CVE-2026-111497
- Sources
From the Briefing, updated 15 minutes ago.
