Source: bleepingcomputer.com
A critical vulnerability nicknamed 'HTTP2Shell' has been discovered in Brotli, the C decoder library embedded within Node.js. The flaw enables attackers to corrupt memory and potentially access sensitive data on affected systems. The severity of the vulnerability has prompted emergency patch releases. Brotli is widely used for compression and is deeply integrated into Node.js, making the attack surface significant. Organizations relying on Node.js-based applications are urged to apply patches immediately. The vulnerability poses risks of remote code execution or data exfiltration depending on the attack scenario. The emergency nature of the patches underscores the critical risk level associated with this flaw.
