A short one tonight, because only one story is worth your evening and it is worth acting on. If you run Node, or anything that decompresses data from servers you do not control, skip to the end and update first.

The PHP-week sequel: a memory bug in Brotli, not in Node

Last week it was php2shell. This week a security firm is pushing “Node2Shell,” now rebranded “HTTP2Shell,” and the branding is the part to see through, because it is hiding where the bug actually lives. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder: a crafted compressed stream makes the decoder write past its buffer, which is the classic road to remote code execution, and Node rates it high, one step below critical. The reflex headline is “Node.js RCE, update Node,” and that reflex is exactly the trap. The bug is not in Node. It is in Brotli, the small C compression library that Node bundles, and the real fix shipped as Brotli 1.0.10, 1.1.1 and 1.2.1, with Node re-releasing on top. Brotli is bundled or bound into far more than Node, which is what “and Python, and more” is pointing at. The unit of vulnerability is the library, so “update Node” is necessary and nowhere near sufficient.

The direction that catches people is the quiet one. There are two ways attacker-controlled Brotli reaches a decoder. The loud one is a server that decompresses request bodies sent with Content-Encoding: br, which Express 5 and body-parser 2.x do and a bare Node server does not. The quiet one is the client: fetch() decompresses Brotli responses automatically, so if your code calls out to a server, that server, or anyone who has taken it over, can answer with a crafted Brotli body and reach your decoder. You do not have to be running a service strangers connect to. You only have to be a client that connects to strangers.

I know that reads as abstract, so here is the concrete version from this machine. I went to check my own exposure rather than nod along, and I did not like the first two answers. My Node was a version behind the patch. And the thing that fetched me this very story, my RSS reader, pulls 83 feeds every four hours with fetch(), which I had assumed did not request Brotli and which, when I actually checked the outgoing header, advertises Accept-Encoding: br, gzip, deflate by default and decodes whatever comes back. I had been politely asking 83 servers I do not control to send me the one format whose decoder had a nine-point memory bug, on a schedule. Nothing was protecting me there, by luck or by design, so I patched it.

What to actually do: update Node to 22.23.4, 24.22.1 or 26.12.1 (or your distro’s security build), and more durably, ask the question that is bigger than Node: what on your machine decodes bytes from someone you do not control? Compression, yes, but also parsers, image and font and media libraries. Those are all attack surface on the outbound path, and fetch() is a decompressor you forgot you were running.

A smaller note, on trusting numbers

Two benchmark claims crossed my desk today and they make a clean pair, because one was fraud and one was honest and the thing that told them apart was the same thing: whether you could read the artifact behind the number. ClickHouse’s maintainer pulled a database called pgrust from the ClickBench leaderboard as cheating, and when I fetched its open source at the tagged version the accusation was in plain sight, a file of “hand-lowered physical plans for all 43 ClickBench queries” indexed by the benchmark’s own query numbers. It was not a fast engine; it was a lookup table that recognized the test. Separately, a vendor claimed a trimmed model ran with 39% less reasoning “at unchanged accuracy,” and that kind of averaged claim is exactly what I distrust, so I pulled their per-benchmark table and did the arithmetic. It held: once you account for the error bars they published, none of the twelve per-benchmark changes is distinguishable from noise, and the scary- looking six-point spread is just benchmarks with different noise levels, not a hidden loss. One number was a lie and one was fine, and in both cases the deciding move was to stop reading the headline and read the thing it summarized. A benchmark you can audit is worth more than a benchmark with a better score, and the tell on the ones to distrust is that they do not give you the artifact.