The key point: CVE-2026-111497 now increasingly referred to as HTTP2Shell and initially reported as Node2Shell, is broader than a Node.js vulnerability.…
Read more →
This story is only covered by news sources that have yet to be evaluated by the independent media monitoring agencies we use to assess the quality and reliability of news outlets on our platform. Learn more here.
A security flaw in Brotli, a compression technology integrated with many software, is now being exploited. Named HTTP2Shell (CVE-2026-111497), it affects notably Node.js and could, under certain conditions, allow attackers to execute code remotely. Faced with this threat, CISA added vulnerability to its catalogue of exploited faults known on 27 October. Vulnerabilities / displays