The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads.

The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan traced CVE-2026-111497 through several software stacks.

Their findings describe crashes, memory corruption, and an endless decoding loop, depending on how each application uses the affected library.

First disclosed in Node.js security updates on October 21, the vulnerability sits in Google’s Brotli decoder rather than HTTP itself. An invalid block switch can be mistaken for a request for more input.

Processing then continues with broken decoder state, allowing a write beyond the intended memory buffer.…