ActiveTech

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

Python: 26 events in the last 90 days
Previous: earlier the same day · Evolving Threat: http2shell is an RCE in node, Python, and more

What happened

The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.

Summary assembled by rule from the sources below

Why it's spreading

Discussion2 sources are covering it, Hacker News first
Discussion2 new signals from 2 sources in the last 6h
DiscussionCommunity discussion only (2 posts), not yet corroborated

Timeline

08:06
First appeared on Hacker NewsHacker News
11:01
Discussion started on LobstersLobsters

Sources

Community

This week's "node2shell" Brotli vulnerability (CVE-2026-111497) is exploitable in Python, other consumers of BrotliLobsters53 min ago
Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and appsHacker News3 h ago