OTX Threat: Node2Shell / HTTP2Shell Vulnerability May Allow RCE

An out-of-bounds write vulnerability in Google's Brotli decoder, tracked as CVE-2026-111497 and known as Node2Shell or HTTP2Shell, affects Node.js and various other software packages. The critical flaw (CVSS 9.2) can be triggered when vulnerable processes decompress attacker-controlled Brotli data, potentially leading to crashes, memory disclosure, or remote code execution. The vulnerability impac CVEs: CVE-2026-20253, CVE-2026-88771, CVE-2026-109618, CVE-2026-109619, CVE-2026-111497