A new vulnerability, CVE-2026-111497, has been identified in the Brotli decoder. The issue, which has evolved from Node2Shell to HTTP2Shell, impacts Node.js and other software. Microsoft has released critical security updates for the .NET Brotli flaw, and Cloudflare has issued emergency WAF rules. The vulnerability also affects FFmpeg, ClickHouse, and Apache Arrow, highlighting widespread implications across numerous applications.