Is there ever a demo of the "2shell" aspect here? Seems like the issue was fixed because it was thought to produce a hang. Has it ever been confirmed that the issue could result in an RCE? Or is this just hypothetical?
https://www.imperva.com/blog/node2shell-from-brotli-data-to-...
There's also a public POC here, though with the caveat that they demonstrated it only on builds with weaker configurations. https://github.com/dimasma0305/CVE-2026-111497-POC
All that said, we haven't heard the major cloud providers or security labs saying they've seen exploitation in the wild yet.