---
title: Added virtual patch for CVE-2026-111497 (Node2Shell, HTTP2Shell)
summary: null
url: >-
  https://www.fastly.com/documentation/reference/changes/2026/10/added-virtual-patch-for-cve-2026-111497
---

A buffer overflow vulnerability that can lead to remote code execution has been found in the Google Brotli decompression library (versions 1.0.3 through 1.2.0), used by Node.js, Python and other software, and has been assigned CVE-2026-111497. Fastly has created a virtual patch for it that is now available within your account.

If you’ve previously [enabled the **Automatic CVE Virtual Patching** setting](https://www.fastly.com/documentation/guides/next-gen-waf/virtual-patches-for-cves/#enabling-automatic-cve-virtual-patching), we’ve already enabled this virtual patch for your workspace. If you haven’t enabled this setting, you can activate the virtual patch and add protection to your workspaces by following the steps for your control panel below.

## Fastly control panel

1.   Log in to the [Fastly control panel](https://manage.fastly.com).

2.   Go to **Security** > **Next-Gen WAF** > [**Workspaces**](https://manage.fastly.com/security/ngwaf/workspaces).

3. Click **Virtual Patches**.
4. In the search bar, enter `CVE-2026-111497`.
5. Click the **Status** switch to the **ON** position.
6. _(Optional)_ If your workspace is in blocking mode, from the **Mode** menu, leave **Log** selected to immediately log requests when the CVE-2026-111497 signal is observed or select **Block** to immediately block requests when the signal is observed.

## Next-Gen WAF control panel

### Professional or Premier platform

1.   Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).

2.   From the **Sites** menu, select a site if you have more than one site.

3. From the **Rules** menu, select **Templated Rules**.
4. In the search bar, enter `CVE-2026-111497` and then click **View** for the CVE-2026-111497 templated rule.
5. Click **Configure**.
6. In the **Configure thresholds and actions** area, click **Add trigger**.
7. Select the **Block requests from an IP immediately if the CVE-2026-111497 signal is observed** checkbox.
8. Click **Update rule**.

### Essential platform

1.   Log in to the [Next-Gen WAF control panel](https://dashboard.signalsciences.net).

2.   From the **Sites** menu, select a site if you have more than one site.

3. Click the **Signals** tab.
4. In the search bar, enter `CVE-2026-111497` and then click **View** for the CVE-2026-111497 tag.
5. Click the **Configuration** tab.
6. Click the **Detections** tab and then **Add detection**.
7. Verify the switch is set to **Enabled**.
8. Click **Create detection**.
9. Click the **Alerts** tab and then **Add alert**.
10. In the **Status** area, set the switch to **Enabled**.
11. Click **Save alert**.