Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

What happened?

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]

Key details

• The flaw affects Brotli versions 1.0.3 through 1.2.0 and impacts Node.js, Python HTTP clients, and .NET.
• Attackers can exploit the vulnerability by causing an application to decompress malicious Brotli data via HTTP responses or requests.
• Microsoft issued an emergency update for .NET warning that exploitation allows privilege escalation on vulnerable systems.
• Proof-of-concept exploits have been published but no malicious exploitation in the wild has been reported.
• Updating the system Brotli library does not fix Node.js or other apps that bundle their own copy of the library.
• Blocking inbound Brotli requests does not prevent exploitation via malicious HTTP responses.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.