The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.
Googleの圧縮形式「Brotli」に深刻な脆弱性「HTTP2Shell」、Web関連に幅広く影響／OpenAIが発見した「Node2Shell」の影響が拡大、認証なしでリモートコード実行のおそれ
米Googleのデータ圧縮アルゴリズム「Brotli」のC言語実装で、認証なしにリモートからメモリを破壊できる深刻な脆弱性「CVE-2026-111497」が発見された。当初、米OpenAIによって「Node.js」の問題として報告されたこともあり 「Node2Shell」 と呼ばれていたが、のちの調査でHTTPを扱うさまざまなライブラリやアプリにも影響が及ぶことが判明。セキュリティ企業のAikido Securityなどが 「HTTP2Shell」 という呼称を用い始めている。
Brotli vulnerability (CVE-2026-111497) — Patch the Planet
Brotli decoder vulnerability: affected software, fixed releases, and how to disable Brotli decoding while you patch.
深刻なのはPHPやNode.jsだけじゃない。Google製技術の脆弱性「HTTP2Shell」対応急務
Googleが提供するオープンソースのデータ圧縮アルゴリズム「Brotli」において、メモリの内容漏洩や認証なしでのリモートコード実行につながる脆弱性(通称: HTTP2Shell)が明らかとなった。10月21日にPHPの脆弱性「PHP2Shell」と同じ日にNode.jsの脆弱性「CVE-2026-111497」として報告されたが、その後ほかのアプリケーションにも影響があると判明したことから、対応が進められている。
GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog
A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
GitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.
Release v0.42.0 · mswjs/interceptors
v0.42.0 (2026-07-22) Implements TCP/TLS wrap-based interception (#770) (8a8fe6f) @kettanaito ⚠️ BREAKING CHANGES Node.js v22 is the minimal supported version. getRawRequest utility has been remo...
GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code
GitLab fixed CVE-2026-97229 (CVSS 10.0), a CI/CD flaw that could allow unauthenticated code execution under certain conditions.
PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)
PHP fixed two remote code execution bugs on October 21. They affect PHP 5.4 and later. An attack needs specific knowledge of the target server and specific c...
How an Omitted Write Barrier in V8 Turns Into RCE in Chrome: CVE-2026-5865
In March, our system detected a severe vulnerability in V8, the JavaScript engine used by Chrome. This vulnerability enabled remote code execution against billions of Chrome users worldwide.
Add Go 1.24+ native H2C support examples by AndrianBdn · Pull Request #6 · thrawn01/h2c-golang-example
Starting from Go 1.24, HTTP/2 Cleartext (H2C) is supported natively in the standard library, eliminating the need for golang.org/x/net/http2/h2c package or workarounds. Since this repository ranks ...
Your Sites Are Protected Against the PHP2Shell Vulnerabilities
Today, the PHP project released security updates for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell.” Both are rated…
Some Secret Management Belongs in Your HTTP Proxy - exe.dev blog
do third-party integrations via HTTP header management
Node.js Cryptography Overhaul: Migrating from SHA-256 to Post-Quantum Algorithms | Markaicode
Learn how to upgrade your Node.js applications from SHA-256 to quantum-resistant cryptographic algorithms with practical code examples and migration strategies.
Cache8063/atauth
AT Protocol (Bluesky) authentication library for Rust, TypeScript, and Node.js
Cloudflare Workers, Deno Deploy, Netlify Edge, and Vercel Edge all have (partial) native Node.js support. But how much? Made a test suite to check this live! > github.com/pi0/platform-node-compat
GitHub - pi0/platform-node-compat: Display Node.js compatibility of edge runtimes
github.comUpdated my @leaflet.pub post with a few more ATProto apps I've come across: ichris.leaflet.pub/3mg6af5oof22p
Other Apps to Use with Bluesky that Aren't the Social Network We Know as Bluesky - Shouting Into the Void
ichris.leaflet.pub
