Google Brotli flaw CVE-2026-111497 enables remote code execution across NodeJS, Python, C++ libraries; OpenAI discovered vulnerability in February, patches now available for most affected platforms.

Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.

TL;DR⚠️ Brotli is a widely used compression library from Google. On Wednesday, October 21st NodeJS disclosed CVE-2026-111497, dubbed “node2shell,” wherein a Node.js process that decompresses attacker-controlled Brotli data can be made to leak memory or run arbitrary code. On Thursday, Python disclosed that Python packages were vulnerable to CVE-2026-111497 as well.On Friday, October 23rd, it has become known that this CVE affects other major languages and service applications using HTTP, where p...