Http2Shell: Node.js Brotli vulnerability (CVE-2026-111497)

Update from October 24, 2026

Dynatrace team continues with the investigation. Patches are being applied where necessary.

OneAgent Updates

Updates containing a patch for Dynatrace OneAgent are available. Release Notes will follow. Please update OneAgent actively if OneAgent automatic updates are disabled:

  • OneAgent 1.347

Updates for other supported OneAgent versions will follow shortly.

Other Dynatrace edge components (Managed, ActiveGate, Operator…) are not impacted by CVE-2026-111497.

Update from October 23, 2026

The Dynatrace team is actively reviewing the recently published news about the Node.js Brotli vulnerability (CVE-2026-111497) – Node2Shell.

Investigation is ongoing and patches are being applied where necessary.

Get article updates or report security vulnerabilities

Dynatrace takes a proactive approach in communicating security vulnerability information to customers. Learn more about Dynatrace security and our security policy. To report a security issue, email security@dynatrace.com.

RSS feed Report issue