Progress is there, but it's mending a small part of a large wound.

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.

IntroductionThis summary covers PRs merged between October 26 and 27, 2026, across six repositories, including Fluent UI, ...

A vulnerability with the ominous name 'HTTP2Shell' is currently a hot topic. Its severity is 9.2 out of 10 (CVSS 4.0). It is ...

Brotli decoder flaw CVE-2026-111497 affects Node.js, Bun, Python packages and Envoy; code execution was demonstrated on one ...

New research from cloud security firm Wiz reveals that 91% of cloud environments contain resources vulnerable to ...

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt ...

Pickering Interfaces, a provider of modular signal switching and simulation solutions for electronic test and verification, ...

To address a vulnerability in Google's Brotli compression technology that could allow attackers to corrupt process memory, ...

IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is ...

An out-of-bounds write in Google’s Brotli decoder affects multiple software ecosystems, prompting security updates for .NET, ...