Skip to content
Critical HTTP2Shell Vulnerability in Brotli Affects Multiple Platforms

Critical HTTP2Shell Vulnerability in Brotli Affects Multiple Platforms

First seen 29 Oct 2026, 13:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 15:14 UTC
  • •CVE-2026-111497 is a critical RCE vulnerability in Brotli decompression.
  • •Exploitation confirmed in the wild; CISA added it to the KEV Catalog on October 27.
  • •Security teams must assess and patch affected systems across various runtimes.

CVE-2026-111497, also known as HTTP2Shell, is a critical vulnerability in the Brotli decompression algorithm, initially identified as Node2Shell. It affects various implementations across multiple runtimes, including Node.js and Python packages. The vulnerability allows for remote code execution (RCE) if attacker-controlled Brotli-compressed data reaches a vulnerable decoder. As of October 27, 2026, the vulnerability has been added to CISA's Known Exploited Vulnerabilities Catalog due to confirmed exploitation in the wild. Security teams are urged to assess their systems for vulnerable Brotli implementations and prioritize remediation efforts. The flaw is classified with a CVSS score of 9.2, indicating its critical nature. Organizations must ensure that untrusted compressed data does not reach their Brotli decoders to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-05-09
CVE-2026-42069 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-22
CVE-2026-111497 published
The vulnerability in Brotli decompression was disclosed, initially identified as Node2Shell.
Pasqualepillitteri.It
2026-10-27
CISA adds CVE-2026-111497 to KEV Catalog
CISA confirmed active exploitation of the vulnerability in the wild, urging organizations to prioritize remediation.
Blog.Checkpoint

More articles in this cluster (2)

Following this threat?

Track Check Point and CVE-2026-111497 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 4

Common questions

What systems are affected by CVE-2026-111497?
The vulnerability affects implementations of Brotli decompression across various platforms, including Node.js and Python packages.
How urgent is the response to this vulnerability?
The vulnerability is critical, with confirmed exploitation in the wild, making immediate remediation essential.
What steps should organizations take to mitigate this vulnerability?
Organizations should assess their systems for vulnerable Brotli implementations and apply patches as necessary.