CVE-2026-111497, widely called Node2Shell, affects the shared Brotli C decoder and therefore Python’s Brotli and brotlicffi packages too. A related analysis recommends versions 1.2.1 and 1.2.1.0 or later, respectively, and rebuilding images that bundle them. Exposure depends on processing attacker-controlled Brotli responses or request bodies, not simply using HTTP/2. The Python analysis reproduced invalid decoder behavior, not code execution in Python, and its advisory-registration status was subsequently updated.