node2shell

Autonomous Vulnerability Discovery & Self-Healing Engine for Deep and Ghosty Bugs

PoC, Docker lab, and technical report for CVE-2026-111497 (Node2Shell) — Node.js Brotli decoder invalid block-switch OOB write; validated errno differential and weaponized remote DoS, RCE analysis included.

Find Node.js websites and see which ones need attention. Desktop Node2Shell Scanner for CVE-2026-111497.

Passive Node2Shell (CVE-2026-111497) exposure checker and offline Node.js runtime assessment with branded HTML reports. Python 3.10+, no dependencies, no exploit payloads.

Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.

Read-only Node2Shell patch auditing for Linux, Windows, and macOS, with local, SSH, and container inspection, vendor backport support, and explicit UNKNOWN results.

Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.

Vulnerability checker and remediation guide for CVE-2026-111497 vulnerability in Google's Brotli decoder

Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read-only version check script.

Find vulnerable Brotli (CVE-2026-111497, Broccoli2Shell / Node2Shell / HTTP2Shell) in Kubernetes clusters, container images and Linux hosts. Checks the binaries themselves, not just version numbers, so it catches bundled copies in Node.js, Python, .NET, Bun and Envoy. Read-only, bash only.

HadayaLab Digital Pandemic Fortress — Signed CycloneDX 1.6 SBOM Attestations, Reproducible Lockfile Fixtures & Zero-Exfiltration AST Advisories (PHP2Shell, Node2Shell, React2Shell, EOL PHP, Docker & MCP Skill Poisoning)

Local inventory triage for Node2Shell (CVE-2026-111497): grade every Node, Bun and Brotli copy on disk. Detection-only, no network probes, no payloads.

Node2Shell (CVE-2026-111497) detection-only scanner + lab — RedSide Security

All-in-one tool to detect 2Shell series vulnerabilities

Node2Shell / HTTP2Shell (CVE-2026-111497) exposure-audit kit — read-only scanner + agent prompt pack. Portable: macOS bash 3.2 + Linux. Mutation-tested regression suite, CI on 3 platforms.

Reproducible local Brotli decoder proof for CVE-2026-111497 with a self-checking tuned RCE harness

Security audit and remediation agent for CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder: detect, patch and verify on Debian and Ubuntu

Read-only scanner for the October 2026 eMudhra incident, including pip and certifi, and the Node.js security release.