High-Severity Brotli Vulnerability Spreads to Python and Other HTTP Components
The Google Brotli decoder vulnerability, CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has a CVSS 4.0 score of 9.2. Remote, unauthenticated attackers could exploit it by sending a specially crafted compressed stream, leading to memory corruption, sensitive data leaks, process crashes, or potential arbitrary code execution. Both Node.js and Python components are impacted. Previously disclosed as Node2Shell and later known as HTTP2Shell, the fix for Python's Brotli requires an upgrade…
High-Severity Brotli Vulnerability Extends to Python and Other HTTP Components
The Google Brotli decoder vulnerability, CVE-2026-111497, affects versions 1.0.3 through 1.2.0 and has a CVSS 4.0 score of 9.2. Remote, unauthenticated attackers could send a specially crafted compressed stream to cause memory corruption, sensitive data leaks, process crashes, or potentially execute arbitrary code. Both Node.js and Python components are affected.
The vulnerability was initially disclosed under the name Node2Shell and later became known as HTTP2Shell. Python's Brotli must be upgraded to 1.2.1, and brotlicffi to 1.2.1.0. The patched versions for Node.js are 22.23.4, 24.22.1, or 26.12.1. OpenAI stated that it discovered the issue in February of this year.
Aikido Security
https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497