CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

Reported by Zscaler ThreatLabz (Atinderpal Singh (Senior Manager, Threat Research))

Summary by Cyber Security News28 Oct 2026, 17:11 CET

About this summary. This is a short excerpt from the description that Zscaler ThreatLabz published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.zscaler.com/blogs/security-research/cve-2026-111497-node2shell-http2shell-vulnerability-may-allow-rce

IntroductionOn October 21, 2026, the Node.js project disclosed CVE-2026-111497, an out-of-bounds write vulnerability in Google’s Brotli decoder used by Node.js and other software. The vulnerability is also known as Node2Shell and more recently as HTTP2Shell. The CVE score, filed by Google as the numbering authority, is 9.2 (Critical) on CVSS 4.0.

Read the full article at Zscaler ThreatLabz →

Source attribution: headline and facts are from Zscaler ThreatLabz (zscaler.com). Summary method: excerpt of the source description. See our source attribution policy.