Node2Shell Brotli Flaw Reaches .NET, Python, PHP, Envoy
The bug sits in the shared Brotli decoder, so the fix has to reach every runtime and proxy that decodes untrusted Brotli data. Patch this week. Exploitation is unreported, and code execution has only been shown in a lab.
Must act: Teams running Node.js, .NET, Python with Brotli or brotlicffi installed, PHP for Windows with cURL decompression, or Envoy/Istio with a Brotli decompressor, where request bodies or fetched responses can come from untrusted parties.
Can relax: Services that never decode Brotli from untrusted sources, and anyone who only serves Brotli-compressed responses, do not reach the vulnerable decoder.
- Inventory every place that decodes Brotli: node -v, dotnet --list-runtimes, pip show Brotli brotlicffi, and the Envoy/Istio proxy versions in your meshes and gateways.
- Upgrade to the fixed releases (Node.js 22.23.4/24.22.1/26.12.1, .NET 8.0.33/9.0.22/10.0.14, pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0", Envoy/Istio patch releases) and restart the processes.
- Rebuild and redeploy container images, self-contained .NET apps and anything that bundles its own Brotli copy; a patched system libbrotli does not fix them.