Security Advisory: Node2Shell Vulnerability (CVE-2026-111497)

Incident Report for Obsidian Security

Monitoring

Security Advisory: Node2Shell Vulnerability (CVE-2026-111497)
Published: Oct 27, 2026

Summary
Obsidian Security has assessed the recently disclosed vulnerability known as Node2Shell (CVE-2026-111497), also referred to as HTTP2Shell.

Our response
We identified a limited number of affected services and are actively patching and redeploying them.

As an immediate mitigation, we implemented Brotli content-encoding blocking at our production API gateways (completed Oct 26, 2026), protecting against Node2Shell and related HTTP2Shell variants.

Customer Impact
We have observed no customer impact to date. We will update this advisory once the patching is completed on our side.

Questions
For questions, please contact your Obsidian account team or support via support@obsidiansecurity.com or the Admin Portal.

Posted Oct 27, 2026 - 14:01 PDT

This incident affects: Security Advisory.