#brotli

Illustration of a tiny eight-byte memory buffer overflowing with compressed data that spills into neighbouring memory blocks

SecurityOctober 26, 2026

HTTP2Shell: Brotli bug sends Node.js, Python and .NET into patch panic

The HTTP2Shell flaw in the Brotli decoder has set off a chain of emergency patches, from Node.js and Python all the way to Microsoft's .NET. If your app decompresses Brotli data from the outside world, you may be exposed.

The Monday letter

The tech and security week, every Monday in your inbox

What to patch first, data breaches, the articles with pictures. Free, no ads, one-click unsubscribe.