Member-only story

“http2shell” Is Actually a Brotli Bug 💥📦

Why Google’s 8-month-old C fix in decode.c left Node.js fetch(), Python httpx, and your AI web scrapers wide open.

Xiuer Old

6 min read6 hours ago

Press enter or click to view image in full size

If you opened Hacker News or your team’s security Slack channel today, you probably saw an urgent alert about “http2shell” . Security advisories called it a remote code execution vulnerability across Node.js, Python, and .NET.

With a name like http2shell , your first instinct is to check your Nginx ingress controllers, your Envoy proxies, and your HTTP/2 frame parsers.

Save your weekend. The bug has nothing to do with the HTTP/2 protocol.

The vulnerability sits inside google/brotli ( <= 1.2.0 ), the C reference library that compresses and decompresses HTTP payloads marked with Content-Encoding: br .…