HTTP2Shell (CVE-2026-111497): pip-audit Missed Brotli. How to Check Your Stack

Also called Node2Shell: a 9.2 Brotli decoder bug in requests, httpx, Node, Bun and Envoy. Copy-paste checks, fixed versions and a workaround.