YHK - yet another hacker news clone

Evolving Threat: http2shell is an RCE in node, Python, and more

81 points cowlevel 2 hours ago 31 comments

cowlevel 2 hours ago | parent

Likely mitigation: disable brotli (br) content-encoding on both sides

thayne 30 minutes ago | parent

Unfortunately, AFAICT, there is no way to do this for node's fetch. I suspect there are other client libraries that don't have a way to disable it.

adzm 1 hour ago | parent

Interestingly the commit that fixes this in brotli dates back to February https://github.com/google/brotli/commit/0ed4268a4401abcb4472...

cowlevel 1 hour ago | parent

OpenAI's tweet says it wasn't recognized as security relevant so wasn't important enough to make a release - until their agent realised it was.

https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338

dofm 33 minutes ago | parent

Until their agent realised there was a good chance of a press release in it.

SV_BubbleTime 6 minutes ago | parent

Chat, we need to constantly be justifying our absolutely absurd IPO. Use UltraMegThink and reference the ExploitToGetUsRegualtoryCapture.md. kkthnx

Sytten 1 hour ago | parent

Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.

rvanlaar 1 hour ago | parent

It looks like brotli <= 1.2.0 is vulnerable.

The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/

QuadmasterXLII 1 hour ago | parent

is flask hello world with gunicorn behind apache vulnerable?

TZubiri 1 hour ago | parent

what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected

whether a hello wolrd in fastapi is affected might also be interesting

cpburns2009 14 minutes ago | parent

Only decompression with Google's brotli library is affected. So if you use "Brotli" or "brotlicffi" in your Python app to decompress brotli, you're vulnerable. Compressing responses with brotli from Apache is safe.

DogeGode 1 hour ago | parent

Another day, another buffer-overflow vulnerability in C code …

bibekadhikari 1 hour ago | parent

Worth checking how brotli actually reaches your stack. In Node it's bundled into the runtime itself (zlib's brotli support), so an audit of your package tree won't surface it the way a normal dependency would - the fix arrives with a runtime release, not a package bump. The Python package on PyPI is already at 1.2.1. Until your runtime picks up the patched brotli, refusing br content-encoding at the edge seems like the fastest mitigation.

thayne 26 minutes ago | parent

> refusing br content-encoding at the edge seems like the fastest mitigation.

That's pretty difficult if you make outbound requests, and don't already have a TLS interception proxy set up.

cowlevel 13 minutes ago | parent

This is an AI karmabot comment, it should remain flagged

anonymous908213 1 hour ago | parent

I could do without every memory bug getting a cute sensational name and marketing push, I have to say.

lovich 48 minutes ago | parent

that ship sailed a while ago. Rowhammer is the first one I can remember

vinkelhake 46 minutes ago | parent

Let's not forget about heartbleed!

mhio 44 minutes ago | parent

That was the first exploit logo I can recall

judge2020 30 minutes ago | parent

Back in the email days the virus authors named them, e.g. YouAreAnIdiot, ILoveYou

dboreham 54 minutes ago | parent

This is a better article: https://www.aikido.dev/blog/python-packages-vulnerable-node2...

and this is the actual CVE report, which doesn't say much: https://www.cve.org/CVERecord?id=CVE-2026-111497

kylepomykala 46 minutes ago | parent

They just keep coming, don't they?

hoppp 24 minutes ago | parent

Never gonna stop. Consider it normal. Hey, at least humans still have a job. Incident response

awakeasleep 22 minutes ago | parent

Let's not kid ourselves, llm's are already doing the incident response for this in many infrastructure teams

hoppp 16 minutes ago | parent

But they don't respond with fear and flailing arms!

kccqzy 22 minutes ago | parent

There’s apparently no writeup on exactly what was the fix. So I’m going to make a guess that this is the chromium commit that fixed the problem: https://source.chromium.org/chromium/chromium/src/+/224140d4...

And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.

Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.

cpburns2009 20 minutes ago | parent

Here's the normal link:

https://x.com/AikidoSecurity/status/2113759110625906950