Software runtime maintainers have released emergency out-of-band security updates resolving a maximum severity memory corruption vulnerability in core decompression libraries. Unauthenticated remote actors can transmit malformed compressed HTTP data streams to trigger heap corruption and execute arbitrary system code.
The vulnerability, tracked as CVE-2026-9721 and dubbed HTTP2Shell (also Node2Shell and Broccoli2Shell) carrying a CVSS score of 9.8, affects the C-based Brotli decompression library integrated across Node.js, Microsoft .NET, and Rust runtime environments. The defect involves an integer overflow within decompression buffer allocation handlers. Unauthenticated remote adversaries transmit malformed Brotli-compressed HTTP response payloads to corrupt process heap memory, achieving arbitrary code execution on client applications and microservices parsing compressed network streams.
Subverting core compression runtimes introduces widespread supply chain risk across enterprise microservices and web crawlers. Because Brotli decompression runs automatically within application runtimes handling HTTP/2 and HTTP/3 traffic, unauthenticated memory corruption allows remote threat actors to execute arbitrary code without user interaction.
– Apply emergency out-of-band updates released for Node.js, Microsoft .NET framework, and Rust Brotli crate dependencies immediately.
– Inspect cloud application container images for vulnerable Brotli library binaries and rebuild deployment artifacts.
– Enforce egress web application proxy filtering to inspect incoming HTTP compressed responses for anomalous stream headers.
– Restrict process execution privileges across microservice containers using fine-grained sandboxing policies.
Application runtime defense requires rapid dependency patch execution and strict container isolation to ensure microservice infrastructure remains insulated from unauthenticated decompression memory corruption exploits. #CodeDefence #HTTP2Shell #Brotli #NodeJS #DotNet #Microsoft #SupplyChain #RCE #AppSec #PatchManagement
/
