A critical out-of-bounds write in the Brotli decompressor, tracked as CVE-2026-111497 and named HTTP2Shell, affects many popular programs that decompress data from the network. Envoy published fixed versions 1.40.0, 1.39.3, 1.38.6, 1.37.8 and 1.36.12 on 23 October. Fixes are also available for Node.js in versions 22.23.4, 24.22.1 and 26.12.1, for Bun 1.4.4 and for the Python libraries Brotli 1.2.1 and brotlicffi 1.2.1.0. After updating, processes must be restarted and container images that include the library rebuilt.

What it means: Brotli is used everywhere to compress web pages and API data, so a flaw in its decompressor can be reached by anyone who sends data to a server or by any application that downloads content. Out-of-bounds writes are among the most dangerous bug classes, because in some conditions they lead to code execution, not just a crash. For Greek businesses running applications on Node.js or Python, or using Envoy as a proxy, for example inside Kubernetes or a service mesh, the priority is clear: find where the library is used, update to the fixed versions and restart. Installing a new package is not enough if processes keep running the old code in memory. Container images must be rebuilt, because they often carry their own copy of the library that the host operating system does not update. Dependency scanners, such as tools that check an SBOM, help find indirect uses inside other packages. For providers covered by NIS2 or DORA, handling and recording this update quickly is part of their vulnerability-management duties and should be documented.

Read the original on Envoy Proxy (GitHub Security Advisory)

Related service: Custom software

Related stories