The Brotli vulnerability CVE-2026-111497, nicknamed HTTP2Shell, is a buffer overflow in Google's compression decoder that can crash processes, leak memory and allow remote code execution in Node.js, Python and .NET applications. Proof-of-concept exploits are public, and updating the system Brotli package, the fix most admins try first, leaves many deployments still vulnerable.
