Microsoft and others scramble to patch Node.js flaw which could be the next PHP-level issue

An RCE flaw was found in Brotli, a Google-built open-source data compression algorithm.
CSO Online

Node2Shell puts Microsoft and Node.js on Brotli patch duty

An out-of-bounds write in Google’s Brotli decoder affects multiple software ecosystems, prompting security updates for .NET, ...

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt ...
SecurityWeek

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.
CSO Online

Bright Security Introduces STAR Fuzzer, Agentic Fuzzing That Writes Its Own Harnesses and Proves Every Finding

Built on an evolutionary engine first released in 2018, STAR Fuzzer by Bright Security finds crashes, memory exhaustion and ...
Tech Critter

HTTP2Shell Flaw: Critical Brotli Vulnerability Explained

HTTP2Shell is a critical flaw in Google's Brotli decoder affecting Node.js, Python, Bun and other software. Learn about the ...