HTTP2Shell: CVE-2026-111497 is a Brotli flaw, and it is bigger than Node.js
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, not a Node.js bug. Versions 1.0.3 through 1.2.0 are affected on all platforms, fixed in 1.2.1 or the 1.0.10 and 1.1.1 backports, and the flaw works in both directions. This desk's 22 October Node.js story framed the scope too narrowly, and this is the correction.