Update: Node2Shell becomes HTTP2Shell — Python HTTP stacks exposed
The Brotli OOB-write (CVE-2026-111497) gives requests, httpx and aiohttp a pre-auth RCE. Patch matrix and stopgaps inside, plus an open image model.
Copy markdown
Your Python HTTP stack inherited it
The bug lives in Brotli's shared C decoder (1.0.3–1.2.0), not the Node runtime — so PyPI's `Brotli` and `brotlicffi` ship the same flaw. With the brotli extra installed, requests/urllib3, httpx and aiohttp decode attacker-sent Brotli automatically, meaning pre-auth RCE even if your code never imports it. Fix: `Brotli` 1.2.1 and `brotlicffi` 1.2.1.0.
The patch matrix
Node 22.23.4 / 24.22.1 / 26.12.1 are fixed; Node 20, 23 and 25 get no patch, so plan a migration. Also bump Bun to 1.4.4 and system libbrotli to 1.0.10 / 1.1.1 / 1.2.1. Rebuild your images — pinned tags like `node:24.22.0` stay vulnerable — update lockfiles, and restart processes, since the old decoder lingers in memory.
PoC out, no in-the-wild yet
Public PoC code has sat on GitHub since Oct 21–22, and Imperva demoed lab code-exec on a stock Node 24.22.0 build — but it's not in CISA KEV as of Oct 23 and no active exploitation is confirmed. GovCERT.CZ has issued a warning. Translation: patch today, but don't panic-deploy an untested fix.
Can't patch yet? Stopgaps
Block `Content-Encoding: br` request bodies at your proxy or WAF; in Express 5, `express.json({ inflate: false })` works but also rejects gzip, so test clients first; in Python, uninstall the optional brotli packages. One thing that does NOT work: stripping `br` from `Accept-Encoding`, since attackers send it regardless.
Weekend build: open, layout-aware image gen
OpenMOSS released MOSS-Image under Apache 2.0 — a 5B diffusion transformer that takes JSON prompts with bounding boxes and literal text strings, built for posters, UI mockups and infographics where legible text matters. Weights are on Hugging Face and ModelScope with a ComfyUI plugin; the SFT checkpoint is ~27GB. Note the top-end results lean on a GPT-6 prompt-enhancer, not the generator alone.