http2shell

A newly dubbed vulnerability, http2shell, allows remote code execution across popular development platforms including Node.js and Python. Security researchers at Aikido Security are warning that the threat is still evolving, and developers are discussing the scope of affected runtimes and how quickly patches or mitigations need to be applied across web infrastructure.

A newly disclosed vulnerability, tracked as CVE-2026-111497 and dubbed 'HTTP2Shell', affects .NET and related runtimes, allowing potential remote code execution via HTTP/2. Microsoft has issued emergency updates covering PowerShell and other components, while Node.js has shipped patched releases 22.23.4, 24.22.1 and 26.12.1, fixing ten vulnerabilities in total. Administrators are being urged to patch immediately.

Security researchers report that the Node2Shell vulnerability class has evolved into HTTP2Shell, extending the impact to a wide range of HTTP libraries and applications rather than only Node.js packages. The development raises concerns about how many projects may be exposed, with Python packages such as Brotli cited in connection with the flaw.

Newly disclosed vulnerabilities in Brotli decoder implementations have been given names including Node2Shell, Broccoli2Shell and HTTP2Shell, suggesting the flaws could allow attackers to achieve remote code execution in environments that parse Brotli-compressed data. Brotli is a compression format widely used across web servers, browsers and developer tooling, so affected libraries are broadly deployed. Esri has published an advisory referencing the issues, and security teams are checking whether their products embed vulnerable decoder code.