Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.
Summary
The article analyzes the CVE-2026-111497 Brotli vulnerability (Node2Shell) that can cause memory leaks or remote code execution when attacker-controlled Brotli data is decompressed. It expands from Node.js to Python and potentially other languages, outlining patched versions across multiple projects and practical mitigations. It also highlights how Aikido's tools can detect vulnerable Brotli dependencies and guide remediation.