[ Removed by Reddit on account of violating the content policy. ]

On 21 October 2026, Google released patched versions of its Brotli compression library for CVE-2026-111497, a vulnerability nicknamed Node2Shell. It is an out-of-bounds write in the Brotli decoder (fixed builds 1.0.10, 1.1.1 and 1.2.1), reachable through Content-Encoding: br on both incoming requests and fetched responses.

I made an interactive, hands-on lab exercise on this vulnerability. The goal is to give defenders a general overview of the attack vector and the containment steps. You'll exploit it as an attacker, then switch roles to the defender's side and see why an edge block is only a stopgap, why the runtime has to be upgraded, and why secrets have to be rotated even after the patch.

I did my best to highlight all the details, but if you notice any issues or inconsistencies, please let me know!

https://ransomleak.com/exercises/http2shell-rce/