Matteo Collina

Node.js maintainer, co-author of the October 21 fix

Appears in 1 story

Stories

Brotli decoder flaw evolves into HTTP2Shell, expanding remote code execution across stacks

Active maintainer

A single memory bug went from an unlabeled commit in Google's Brotli library in February to a critical vulnerability called HTTP2Shell by late October. Node.js patched it on October 21; three days later researchers had traced it across Python HTTP clients, Bun, curl, and Express middleware that decode Brotli by default.

Updated 2 hours ago