A critical flaw in the widely used Brotli data compression library, nicknamed HTTP2Shell (CVE-2026-111497), can enable remote code execution or memory corruption when the library processes a malicious data stream. The vulnerability has received a critical severity rating. [1, 4, 5, 6, 9, 14]
The flaw affects numerous platforms that bundle Brotli, including Microsoft's .NET framework, Node.js, and various Python packages. [3, 9, 10]
Microsoft issued rare, out-of-band emergency security updates for several versions of .NET. [3, 11, 13] Developers of other affected platforms have also released urgent patches and advised users to update their systems immediately. [1, 17]