AmazonAnalysisAWS updates Lambda and container runtimes for Brotli Node2Shell flaw
What happened.Amazon Web Services published security bulletin AWS-2026-155 detailing patched managed runtimes and container images to address an out-of-bounds write vulnerability in the native Brotli compression library.
Why it matters.Serverless applications and web APIs routinely accept compressed request bodies to reduce bandwidth overhead. When memory vulnerabilities exist inside foundational native decompression libraries, managed application runtimes risk arbitrary memory corruption from external web traffic. Developers managing containerized workloads must pull updated Amazon Linux base images and rebuild application artifacts immediately. Security teams should scan container registries for unpatched Brotli dependencies across production deployments.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-111497 with a 9.2 CVSS rating, an unchecked return value in the Brotli C decoder causes heap memory corruption during stream decompression.
- Exploitation path: Remote attackers transmit crafted Brotli-compressed HTTP payloads to serverless handlers or containerized APIs, triggering heap corruption that can result in denial of service or remote code execution.
- Remediation releases: AWS deployed automatic patches across managed AWS Lambda Node.js runtimes and published updated Amazon Linux base container images in the Amazon ECR public gallery.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: