Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
Image from Aikido (@AikidoSecurity)

Oct 23, 2026 · 10:26 PM UTC

118
852
429
3,452
810,779
RelevantRecentLikes
nitter.cf/pilvar222/status/21151…
pilvar (Philippe Dourassov) (@pilvar222) profile picturepilvar (Philippe Dourassov)
@pilvar222Oct 27
We made a website to check if your http client is vulnerable to CVE-2026-111497 (Node2Shell/HTTP2Shell) brotli.aikidosec.com/ Also open-source: github.com/AikidoSec/brotli-… Some examples:
5
264
@AikidoSecurity
Image from Jose Zertuche (@joszert)
23
234
12,398
remember those sysadmin dudes from the '90s who said the internet wasn't safe that
2
49
6,904
@AikidoSecurity
Image from Andras Bacsai (@heyandras)
2
1
18
3,214
say what you will about aikido, naming it http2shell will get it patched faster than any advisory
1
16
5,486
pre auth rce on plain http. patching tonight
6
2,445
Tracked at broccoli2shell.com

Broccoli2Shell — CVE-2026-111497

A Brotli decoder bug reaches Node.js, Python and more. Affected versions, checks and fixes.

broccoli2shell.com
1
3
2,522
i think i picked the wrong profession
2
3
64
8,094
pre-auth through decompression means it fires before any of your own code runs
2
21
7,410
First PHP, then node.js, and now with python in the mix I think I chose the wrong profession. Maybe it is not too late to start over.
1
16
4,909
paid for by big Node lobby
11
5,428
The fact that many stupid Web developers decided to add support for content encoding compressed in request is inane to me. nitter.cf/TheThing89/status/2113…
Jónatan Nilsson ✝️ (@TheThing89) profile pictureJónatan Nilsson ✝️
@TheThing89Oct 22
Replying to @RonMasas
The lesson here is to NOT use express js version 5+ or body parser 2.0+ because this is very nonstandard and pointless to support.
1
7
4,439
It's always decompression
5
4,339
brotli pre-auth RCE? decompression bugs have been quietly farming shared hosts for years. blast radius on anything terminating h2 with a brotli dict is grim
4
2,030
@AikidoSecurity
1
1,631
Vay be, bu CVE 2026 111497 olayı Node.js ve Python'dan HTTP2Shell'e sıçramış, hem de bu kadar geniş bir etki alanı varmış, bu gerçekten düşündürücü bir durum.
2
@AikidoSecurity
1,311
@AikidoSecurity
211
Base images still ship the old decoder
11
HTTP2Shell naming feels a bit ahead of the repro. Blast radius is real, but I'd hold the headline until an end-to-end pre-auth chain is public.
610
pre-auth RCE via Brotli decompression. same CVE family keeps mutating, so check your HTTP libs and not just node/python runtimes.
285
BRotli decompress as pre-auth RCE path again. Any source on which libs are actually hit? without a repro this is just a CVE name to me
883
@grok is my Laravel stack deployed on forge vunarable?
1
3,708
@grok 詳細サクッと教えて
1
3,742
@grok httpsなら平気なの？httpだけ？
1
1,289
@grok fastapi via gunicorn affected?
1
1,074
Load more replies