Security Advisory: Node2Shell Vulnerability (CVE-2026-111497)

Security Advisory: Node2Shell Vulnerability (CVE-2026-111497) Published: Oct 27, 2026 Summary Obsidian Security has assessed the recently disclosed vulnerability known as Node2Shell (CVE-2026-111497), also referred to as HTTP2Shell. Our response We identified a limited number of affected services and are actively patching and redeploying them. As an immediate mitigation, we implemented Brotli content-encoding blocking at our production API gateways (completed Oct 26, 2026), protecting against Node2Shell and related HTTP2Shell variants. Customer Impact We have observed no customer impact to date. We will update this advisory once the patching is completed on our side. Questions For questions, please contact your Obsidian account team or support via support@obsidiansecurity.com or the Admin Portal.