Node2Shell has evolved into HTTP2Shell, a critical vulnerability impacting many HTTP libraries and applications. The bug (CVE-2026-111497) specifically affects Python packages that use the Brotli compression library, with particularly severe blast radius across widely-deployed HTTP components.
Background
Node2Shell is a well-known family of heap corruption vulnerabilities in Node.js's libuv and related compression libraries. CVE-2026-111497 represents a significant escalation from the original Node2Shell, now affecting the broader HTTP ecosystem through Brotli implementations.
- Source
- Hacker News (RSS)
- Published
- Oct 24, 2026 at 04:06 PM
- Score
- 8.0 / 10