Response to CVE-2026-111497 (Brotli decoder, "Node2Shell")

We have completed our initial investigation into CVE-2026-111497, an out-of-bounds write in the Brotli decompression library (CVSS v4 9.2) disclosed on October 21, 2026. The flaw is also referred to as "Node2Shell" and "HTTP2Shell." This update summarizes where we stand so that customers responding to supply chain security questionnaires have a direct reference point.

Our investigation. We reviewed our repositories, application stacks, and container images for affected Brotli decoders, including components beyond Node.js. We identified a small number of components that included an affected decoder, and we have updated all dependencies within our control to patched versions.

Exposure. We have no confirmed indicators of exploitation on HackerOne-operated infrastructure.

Ongoing work. We continue to track updates from third-party vendors that we depend on, and we will update this page if our assessment changes.

For researchers: findings against HackerOne-owned assets related to CVE-2026-111497 are in scope for our bounty program. Reference the CVE identifier in the report title and body. Review the program scope at hackerone.com/security for the current asset list.