Ghost CMS Websites affected - CVE-2026-111497

CVE-2026-111497Broccoli2ShellA bug in the Brotli decoder lets crafted compressed data write past the end of a buffer. Node.js, Python and anything else built on Google's C decoder needs a patch.Node2Shell evolves to HTTP2Shell. Brotli flaw (CVE-2026-111497) blast radius affects many libraries & apps using HTTPs.Recall noticeBrotli decoder 1.0.3 through 1.2.0. An out-of-bounds write that can lead to a crash, a memory leak or remote code execution. Rated 9.2 Critical (CVSS 4.0) by GitHub, High by Node.js. Affected versions and their replacements ProductAffectedFixed in Google Brotli (C library)1.0.3 – 1.2.01.0.10, 1.1.1, 1.2.1 Node.js 26below 26.12.126.12.1 Node.js 24below 24.22.124.22.1 Node.js 22below 22.23.422.23.4 Node.js 25, 23, 20 and olderall versionsNo fix. These lines are end of life, so move to 22, 24 or 26. Python Brotli1.0.3 – 1.2.01.2.1 Python brotlicffi1.0.3 – 1.2.0.x1.2.1.0 Installing the update isn't enough. A running process keeps the old decoder until it restarts, and…