Node2Shell evolves to HTTP2Shell, blast radius affects many HTTP libs and apps

A vulnerability in the Node2Shell library, which has since been renamed to HTTP2Shell, has been discovered, affecting numerous HTTP libraries and applications. The issue, identified as CVE-2026-111497, has been linked to a Brotli compression bug. The vulnerability is said to be exploitable without authentication, allowing attackers to execute arbitrary code. The affected libraries include Axios, Axios 0.27.2, and possibly others. A patch for the issue has been released, and users are advised to update their libraries to the latest versions to mitigate the risk.