Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

A critical vulnerability (CVE-2026-111497) in Google's Brotli compression library allows remote attackers to leak memory or execute arbitrary code by sending specially crafted compressed data to applications that decompress it. The flaw affects Node.js, Python, and many other major languages and HTTP-based applications, though patches are becoming available for most affected software. Users are advised to disable Brotli decoding until patches are installed if their applications are vulnerable.