Node2Shell CVE-2026-111497 detected via Brotli logs

Node2Shell, tracked as CVE-2026-111497, is an out-of-bounds write vulnerability in Google's Brotli C decoder affecting multiple software runtimes and proxies including Node.js, Python packages, Bun, and Envoy. Security analysis of log samples reveals that the flaw causes decoder crashes and has been exploited in the wild for denial of service and post-exploitation activities such as cryptominer deployments. Mitigation requires patching all dependent Brotli consumers across affected environments and rejecting untrusted Brotli content encoding at the web application firewall. Open article →