Khai Tran

Security researcher at OpenAI Codex Security, reported the vulnerability

Appears in 1 story

Stories

Brotli decoder flaw evolves into HTTP2Shell, expanding remote code execution across stacks

Credited in the Node.js security advisory

A single memory bug went from an unlabeled commit in Google's Brotli library in February to a critical vulnerability called HTTP2Shell by late October. Node.js patched it on October 21; three days later researchers had traced it across Python HTTP clients, Bun, curl, and Express middleware that decode Brotli by default.

Updated 2 hours ago