Node2Shell: Brotli Flaw Hits Python Packages

Reported by SOCRadar (Yağmur Ernalbant)

Summary by Cyber Security News26 Oct 2026, 13:29 CET

About this summary. This is a short excerpt from the description that SOCRadar published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://socradar.io/blog/node2shell-brotli-flaw-hits-python-packages/

The Node2Shell Brotli flaw (CVE-2026-111497), disclosed alongside Node.js fixes on October 21, 2026, also reaches Python through the PyPI Brotli and brotlicffi packages. Both compile Google’s vulnerable Brotli C decoder, and popular HTTP clients such as requests, httpx and aiohttp use them to decompress responses automatically once they are installed. That makes exposure easy to miss.

Read the full article at SOCRadar →

Source attribution: headline and facts are from SOCRadar (socradar.io). Summary method: excerpt of the source description. See our source attribution policy.