I scanned my machine for the Brotli RCE. Three stacks were exposed — and the patched one still reports the vulnerable version.

CVE-2026-111497 (Node2Shell/HTTP2Shell) lives in three Brotli copies on one VM. I measured the pip-audit blind window (closed Oct 23-24), diffed the 1.2.0->1.2.1 fix (3 files that matter), and found Node 24.22.1 is patched but still reports brotli 1.2.0.