Security researchers at Aikido say the flaw first tracked as Node2Shell has evolved into a wider threat they now call HTTP2Shell, warning that it affects many libraries and applications that use HTTP with Brotli or brotlicffi installed. The bug is tracked as CVE-2026-111497 and is described as a remote code execution issue, the same class of flaw that made PHP2Shell so damaging for web servers.
According to Aikido, the blast radius is not limited to Node.js. Any project pulling in a Brotli compression library over HTTP — including Python stacks using brotlicffi — may be exposed. The company's guidance is blunt: check your versions and upgrade to the fix as soon as it is available.
Why HTTP2Shell has a bigger blast radius
The name change matters. Node2Shell framed the issue as a Node.js problem, which pushed many teams to dismiss it if they ran Python, Go or a mixed stack. HTTP2Shell reframes it as a protocol-level problem: the vulnerable surface is the HTTP handling of Brotli-compressed content, not a single runtime.
Aikido's advisory highlights that the exposure spreads through dependencies rather than through code developers wrote themselves. That is what turns a single CVE into a supply-chain event — the fix usually lands upstream first, and reaches applications only after maintainers ship updates and teams rebuild.
Which libraries and apps are affected
The affected component class is narrow but common: libraries that decode Brotli streams inside an HTTP request path, and the brotlicffi bindings used in Python environments. If your service accepts compressed request bodies, terminates HTTP for other apps, or sits behind a proxy that does, it belongs on the review list.
There is no confirmed public exploit chain in the source material, so treat severity claims carefully. What is confirmed is the identifier, CVE-2026-111497, the Brotli and brotlicffi dependency angle, and Aikido's instruction to upgrade. Teams that already patched for Node2Shell should not assume they are covered.
