An out-of-bounds write vulnerability in Google's Brotli decoder, tracked as CVE-2026-111497 and known as Node2Shell or HTTP2Shell, affects Node.js and various other software packages. The critical flaw (CVSS 9.2) can be triggered when vulnerable processes decompress attacker-controlled Brotli data, potentially leading to crashes, memory disclosure, or remote code execution. The vulnerability impacts multiple runtimes including Node.js, Bun, Python, .NET, Envoy Proxy, and Java brotli4j. Exploitation can occur through both inbound malicious requests and outbound responses from compromised servers. Within 24 hours of disclosure, reconnaissance and exploitation attempts were observed from 20 source IP addresses across 402 events, with 40% involving reconnaissance and 60% exploitation attempts. Organizations should immediately patch vulnerable components and monitor for suspicious activity.