CVE-2026-111497, also known as Brotli2Shell, Node2Shell, HTTP2Shell and Broccoli2Shell, is an out-of-bounds write in Google's Brotli decoder library. Software that uses the decoder includes Node.js, .NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. Google, as the CVE Numbering Authority, scored it 9.2 under CVSSv4.0. The impact ranges from a process crash to potential remote code execution.

For more information about the vulnerability, including affected versions, patch guidance, and Tenable product coverage, visit our blog.