HTTP2Shell: the Brotli Decoder Bug That Is Already in Your Runtime and Nobody Imported It on Purpose
An out-of-bounds write in Google’s Brotli C decoder (1.0.3-1.2.0) ships inside Node, Bun, Python, Envoy and Istio. Inbound br bodies and outbound br responses both reach it. Safe lab repro, detection, patch matrix.