Dev Tools · via Hacker News
“HTTP2Shell”: a Brotli bug opens pre-auth RCE across Node, Python and more
Aikido says CVE-2026-111497, first reported in Node.js and Python, now hits many HTTP libraries and apps through Brotli decompression, allowing remote code execution before any login. If your servers accept brotli-encoded requests, patch or disable br content-encoding now.