The key point: CVE-2026-111497 now increasingly referred to as HTTP2Shell and initially reported as Node2Shell, is broader than a Node.js vulnerability. The vulnerability is associated with Brotli decompression, so defenders need to find vulnerable implementations across applications and infrastructure, confirm whether untrusted compressed data can reach them, and patch the affected component. AT A GLANCE · CVE: CVE-2026-111497 · Affected layer: Brotli decompression implementations used by multiple runtimes and infrastructure components · Primary risk question: Can attacker-controlled Brotli-compressed data reach a vulnerable decoder? · Immediate priority: Discover, assess reachability, patch, redeploy, and hunt Context HTTP2Shell emerged shortly after PHP2Shell, but […]
Read the original article:
HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.js