Brotli decoder flaw CVE-2026-111497 reportedly spreads to HTTP-based software

A Brotli decoder vulnerability, CVE-2026-111497, is reported to affect Node.js and also Bun and Python, per The Hacker News. Security outlets describe it as critical and as evolving into an HTTP-related issue called HTTP2Shell.

Timeline

1. 26 Oct, 09:10 UTCFirst appeared on Google Trends
2. 26 Oct, 09:10 UTCPicked up on News
3. 26 Oct, 09:10 UTCThe Hacker News covers Brotli flaw spread
4. 26 Oct, 09:10 UTCwiz.io publishes critical vulnerability explainer

Top sources

• cve-2026-111497Google Trends
• Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used SoftwareThe Hacker News
• Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerabilitywiz.io