Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.
- TL;DR⚠️ Brotli is a used widely compression library from Google.
- On Wednesday, October 21nd NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
- On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well.
Unverified
- TL;DR⚠️ Brotli is a used widely compression library from Google.
- On Wednesday, October 21nd NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code.
- On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well.
Sources: Aikido