Get the latest tech news

Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps


The Brotli flaw behind Node2Shell (CVE-2026-111497) affects many libraries and applications using HTTP with Brotli or brotlicffi installed. Check your versions and upgrade to the fix.

None

Get the Android app

Or read this on Hacker News

Read more on:

Photo of apps

apps

Photo of HTTP

HTTP

Photo of blast radius

blast radius

Related news:

News photo

Around a dozen banking apps began specifically permitting GrapheneOS

News photo

Evolving Threat: http2shell is an RCE in Node, Python, and more

News photo

Android lets you ‘bubble’ apps for easy access now – how it works