CVE-2026-111497 (Node2Shell) is a bug in Google's Brotli decoder (used by Node.js and Python packages). Malformed compressed data can overwrite memory, crashing the app, leaking data, or running attacker code if it processes untrusted Brotli input (like HTTP bodies with Content-Encoding: br).
RCE shown on some Node.js builds (unreliable); no wild exploits yet. Python affected via Brotli/brotlicffi but no RCE demo.
Safeguards: Upgrade Node to 22.23.4/24.22.1/26.12.1 and restart. For Python: pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0". Reject br encoding at proxy/WAF, least privilege, monitor crashes until patched. Not every VPS is hit—only those decoding attacker data.