Security11 min read
HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure
HTTP2Shell is CVE-2026-111497, a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. Also called Node2Shell and Broccoli2Shell, it has fixes in Node.js 22.23.4, 24.22.1 and 26.12.1, plus Brotli 1.0.10, 1.1.1 and 1.2.1.
- Security
- WordPress
- Incident Response
