{"name":"HTTP2SHELL_BROTLI_2026 - campaign","description":"# Executive Threat Brief - HTTP2SHELL_BROTLI_2026 (CVE-2026-111497)\n\n## Campaign Snapshot\nA memory-corruption flaw in Google's Brotli decompression library (CVE-2026-111497, CVSS v4 9.2) lets an unauthenticated attacker corrupt memory, and on Node.js achieve remote code execution, by sending or serving a crafted compressed stream. The same library sits inside Node.js, Bun, Python HTTP clients, Envoy/Istio service meshes, curl and several data engines, so one bug touches internet-facing APIs, webhook and crawler services, AI agents that browse, CI runners and data pipelines. Patches exist for most runtimes; .NET, PHP, Ruby and some data tools were still reported unpatched on 24 Oct 2026 (VERIFY).\n\n## What Is Affected\n\n### Software\n| Software | Vulnerable Version | Safe Version | Action |\n|---|---|---|---|\n| Node.js 26.x | < 26.12.1 | 26.12.1 | Upgrade runtime, rebuild, redeploy |\n| Node.js 24.x LTS | < 24.22.1 | 24.22.1 | Upgrade runtime, rebuild, redeploy |\n| Node.js 22.x LTS | < 22.23.4 | 22.23.4 | Upgrade runtime, rebuild, redeploy |\n| Node.js 20.x / 23.x / 25.x | All (EOL) | None | Migrate to 22, 24 or 26 |\n| Bun | <= 1.4.3 | 1.4.4 | Upgrade; rebuild compiled binaries |\n| Envoy | 1.39.2, 1.38.5, 1.37.7, 1.36.11 (Brotli decompressor on) | 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12 | Upgrade proxies and gateways |\n| Istio | Earlier releases | 1.29.9, 1.30.6, 1.31.2 | Upgrade control plane and sidecars |\n| .NET, PHP brotli ext, Ruby brotli gem, DuckDB, ClickHouse, Arrow (bundled) | Bundled Brotli | Not yet (VERIFY) | Inventory, apply mitigations, watch vendors |\n\n### Containers\n| Image | Vulnerable Tag | Safe Tag | Registry | Action |\n|---|---|---|---|---|\n| node | 24.22.0 and earlier 24.x; 22.x < 22.23.4; 26.x < 26.12.1 | 24.22.1 / 22.23.4 / 26.12.1 | Docker Hub (library/node) | Re-pin base image, rebuild, redeploy |\n| oven/bun | <= 1.4.3 | 1.4.4 | Docker Hub | Re-pin, rebuild |\n| envoyproxy/envoy | Versions above | Versions above | Docker Hub | Upgrade |\n| debian:12 / debian:13 based images | libbrotli1 unpatched | 1.0.9-2+deb12u1 / 1.1.0-2+deb13u1 (VERIFY) | Any | apt upgrade libbrotli1, rebuild |\n\n### Libraries\n| Package | Ecosystem | Vulnerable Range | Safe Version | Action |\n|---|---|---|---|---|\n| Brotli | PyPI | All < 1.2.1 (GHSA lists >=1.0.3) | 1.2.1 | Upgrade, regenerate lockfiles |\n| brotlicffi | PyPI | All < 1.2.1.0 (GHSA lists >=1.0.3) | 1.2.1.0 | Upgrade, regenerate lockfiles |\n| google/brotli (libbrotlidec) | C / system | 1.0.3 - 1.2.0 | 1.0.10, 1.1.1, 1.2.1 | Patch OS package or vendored copy |\n| andybalholm/brotli | Go | Before 23 Oct 2026 fix | Fixed release (crash only) | Update module |\n\n## Business Impact\n- Remote code execution on Node.js services that accept Brotli request bodies (Express 5 default) or fetch external URLs.\n- Credential exposure: a compromised web, webhook or agent worker holds cloud keys, SaaS tokens and database credentials.\n- CI/CD risk: runners and build images on vulnerable runtimes can leak signing keys and publish tokens.\n- Scanner blind spot: Python packages were not flagged by common SCA tools at disclosure, so dashboards may under-report exposure.\n- Long tail: unpatched .NET, PHP, Ruby and data-engine copies keep residual risk open after the main runtimes are fixed.\n\n## Immediate Actions (Next 24-72 Hours)\n| # | Action | Owner | Deadline |\n|---|---|---|---|\n| 1 | Inventory Node.js, Bun, Envoy/Istio versions across repos, images and serverless | Platform Engineering | 24h |\n| 2 | Upgrade internet-facing and URL-fetching Node.js services to 22.23.4 / 24.22.1 / 26.12.1 and restart | Service owners | 48h |\n| 3 | Upgrade PyPI Brotli to 1.2.1 and brotlicffi to 1.2.1.0, or uninstall where optional | Python service owners | 48h |\n| 4 | Upgrade Envoy and Istio; confirm Brotli decompressor filter status | Platform / SRE | 72h |\n| 5 | Patch system libbrotli in base images, rebuild and redeploy | Platform Engineering | 72h |\n| 6 | Apply Express `inflate: false` / WAF `br` body block on services that cannot patch yet | AppSec | 24h |\n| 7 | Review crash and egress telemetry on exposed services; rotate secrets where anomalies appear | SecOps | 72h |\n\n## Key IOCs (Fast Reference)\n| Type | Value | Context |\n|---|---|---|\n| Request header | `Content-Encoding: br` on inbound bodies | Inbound trigger path; unusual for most JSON APIs |\n| Error code | `BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH` (-17) | On a patched host, indicates the crafted pattern was received |\n| Process | Unexpected children of node / python / bun / envoy | Post-exploitation signal |\n| Network | New egress from web, webhook or fetch workers | Post-exploitation callback |\n| Note | No campaign hashes, IPs or domains published | No in-the-wild exploitation reported as of 24 Oct 2026 |\n\n## Risk Summary\n| Dimension | Rating | Rationale |\n|---|---|---|\n| Exploitability | High | Public PoCs; RCE demonstrated on stock Node.js 24.22.0, not reliable on every attempt; no in-the-wild use reported; EPSS ~0.0048 |\n| Blast Radius | Critical | One library across Node.js, Bun, Python, Envoy/Istio, curl, browsers and data tooling; inbound and outbound paths |\n| Persistence Risk | Medium | Bug gives code execution, not persistence; persistence depends on attacker follow-on and credential reuse |\n| Remediation Complexity | High | Runtime upgrades, image rebuilds, process restarts, vendored copies and unpatched ecosystems; npm updates alone do nothing |\n| Business Exposure | High | Internet-facing APIs, webhooks and AI agents hold production credentials |\n"}