{"name":"HTTP2SHELL_BROTLI_2026_INVENTORY - campaign","description":"# Executive Threat Brief - HTTP2SHELL_BROTLI_2026\n\n## Campaign Snapshot\nA memory-corruption flaw (CVE-2026-111497) in Google's Brotli decompression code ships inside Node.js, Bun, Python libraries, Envoy proxies, .NET and many data tools. An attacker who can send compressed data to a service, or make a service download compressed data from them, can crash it, read its memory, or in lab conditions run code inside it. No attacks have been seen yet, but the fix is public and the affected code runs in most of our server-side stack.\n\n## What Is Affected\n### Software\n| Software | Vulnerable Version | Safe Version | Action |\n|---|---|---|---|\n| Node.js 22 / 24 / 26 | below 22.23.4 / 24.22.1 / 26.12.1 | 22.23.4 / 24.22.1 / 26.12.1 | Upgrade, rebuild images, restart |\n| Node.js 18 / 20 / 23 / 25 | all (end of life) | none | Migrate to a supported line |\n| Bun | 1.4.3 and earlier | 1.4.4 | Upgrade, rebuild compiled executables |\n| Envoy (Brotli decompressor on) | 1.39.2, 1.38.5, 1.37.7, 1.36.11 and earlier | 1.40.0 / 1.39.3 / 1.38.6 / 1.37.8 / 1.36.12 (VERIFY) | Upgrade or remove the Brotli decompressor |\n| Istio (Brotli decompression on) | 1.29.0-1.29.8, 1.30.0-1.30.5, 1.31.0-1.31.1 | 1.29.9 / 1.30.6 / 1.31.2 | Upgrade; plan off 1.29 (EOL) |\n| cdxgen standalone binaries/images | 12.8.8 and earlier, 13.4.0 and earlier | 12.8.9 / 13.5.0 (VERIFY) | Upgrade SBOM tooling |\n| .NET runtime | bundles Brotli 1.1.0 | no fix yet | Disable Brotli auto-decompression on untrusted fetches |\n\n### Containers\n| Image | Vulnerable Tag | Safe Tag | Registry | Action |\n|---|---|---|---|---|\n| node | below 22.23.4, 24.22.1, 26.12.1 | 22.23.4, 24.22.1, 26.12.1 | Docker Hub (official) | Rebase and redeploy; OS patching does not fix bundled copy |\n| oven/bun | below 1.4.4 | 1.4.4 | Docker Hub | Rebase and redeploy |\n| envoyproxy/envoy | see Software table | see Software table | Docker Hub | Upgrade where decompressor configured |\n\n### Libraries\n| Package | Ecosystem | Vulnerable Range | Safe Version | Action |\n|---|---|---|---|---|\n| Brotli | PyPI | >=1.0.3, <1.2.1 | 1.2.1 | Upgrade, pin floor, restart workers |\n| brotlicffi | PyPI | >=1.0.3, <1.2.1.0 | 1.2.1.0 | Upgrade, pin floor, restart workers |\n| bun | npm | 1.4.3 and earlier | 1.4.4 | Upgrade |\n| brotli (libbrotli) | Debian / Alpine / RHEL | distro-specific | 1.0.9-2+deb12u1, 1.1.0-2+deb13u1, 1.2.1-r0 | Patch OS, restart dynamically linked processes |\n\n## Business Impact\n- Customer-facing APIs built on Express 5 can be reached by any unauthenticated request carrying a Brotli body.\n- Features that fetch outside URLs (webhooks, link previews, imports, AI agents) can be attacked by any web server the attacker controls; perimeter WAF rules do not inspect these responses.\n- A compromised process exposes the cloud credentials, database secrets and tokens it holds; memory disclosure can leak other customers' request data.\n- CI runners and SBOM generators that process untrusted artifacts carry signing keys and deploy tokens.\n- Standard dependency scanners miss most copies because the code is bundled inside runtimes and binaries, so a clean scan report overstates our patch status.\n\n## Immediate Actions (Next 24-72 Hours)\n| # | Action | Owner | Deadline |\n|---|---|---|---|\n| 1 | Upgrade Node.js and Bun in all base images; rebuild and redeploy internet-facing services first | Platform Engineering | 24h |\n| 2 | Upgrade PyPI Brotli to 1.2.1 and brotlicffi to 1.2.1.0; pin floors in lockfiles | Service owners (Python) | 48h |\n| 3 | Reject `Content-Encoding: br` request bodies at edge and API gateways | Network / Edge team | 24h |\n| 4 | Disable automatic response decoding on services that fetch user-supplied URLs where runtimes cannot be upgraded | AppSec + service owners | 48h |\n| 5 | Upgrade or reconfigure Envoy and Istio where the Brotli decompressor is enabled | Platform Engineering | 72h |\n| 6 | Run binary and image SBOM scans to find vendored copies (.NET, cdxgen, Electron, data tools) | AppSec | 72h |\n| 7 | Rotate credentials held by internet-facing processes that decoded untrusted Brotli on vulnerable builds | Security Operations | 72h |\n\n## Key IOCs (Fast Reference)\nNo network or file IOCs exist; this is a vulnerability, not a malware campaign. Hunt on behavioral signals.\n\n| Type | Value | Context |\n|---|---|---|\n| HTTP header | `Content-Encoding: br` on request bodies | Inbound attempt; rare on legitimate JSON APIs |\n| Log string | `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` / error -17 | Probe rejected by a patched decoder |\n| Process | SIGSEGV / SIGABRT in node, bun, python, envoy after `br` input or outbound fetch | Possible trigger on unpatched host |\n| Symbol | `BrotliDecoderDecompressStream` in binaries | Vendored decoder present; check version |\n\n## Risk Summary\n| Dimension | Rating | Rationale |\n|---|---|---|\n| Exploitability | High | Network-reachable without authentication; lab RCE on one Node.js build; CISA SSVC exploitation none, automatable no |\n| Blast Radius | Critical | Node.js, Bun, Python HTTP clients, Envoy, .NET, browsers, data and firmware tools |\n| Persistence Risk | Medium | Flaw itself gives no persistence; a successful RCE gives an attacker credentials to establish it elsewhere |\n| Remediation Complexity | High | Vendored copies, image rebuilds, process restarts, distro lag, several vendors without fixes |\n| Business Exposure | High | Customer-facing APIs, outbound fetch features and CI hold high-value secrets |\n"}