Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps
A critical vulnerability (CVE-2026-111497) in the Brotli compression library allows for remote code execution across various HTTP clients and applications. The flaw, which affects versions 1.2.0 and earlier, requires manual updates as automated security tools may not yet flag the specific package.
Why it matters
The widespread use of Brotli in web infrastructure makes this a high-impact security risk for servers and clients globally.
Brotli is a lossless compression algorithm and data format developed by Google. It’s a way to make data smaller for storage or sending over the internet. Software then unpacks it to recover the original data. It’s widely used for HTTP compression to compress web content such as HTML, CSS, and JavaScript.
CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder affecting versions 1.0.3 through 1.2.0 on all platforms. This is the same Brotli decoder flaw behind Node2Shell announced a couple days ago. A remote, unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt memory, leak sensitive data, crash the process, or potentially execute arbitrary code. It carries a CVSS v4.0 score of 9.2 (Critical), and Node.js is affected through its bundled Brotli library.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in