A new vulnerability, CVE-2026-111497, has been identified in the Brotli decoder. The issue, which has evolved from Node2Shell to HTTP2Shell, impacts Node.js and other software. Microsoft has released urgent fixes for the .NET Brotli flaw, and Cloudflare has issued urgent web application firewall updates. The vulnerability also affects various key systems, highlighting widespread implications across various environments.