CVE-2026-111497 was recently renamed from node2shell to http2shell as it’s Brotli that’s affected, not necessarily just Node.js.
Roundcube packages Brotli 1.0.9 even in the latest MIAB v78, and can fetch remote stylesheets while displaying HTML emails, decompressing responses before validating the CSS.
There’s also a Nextcloud path via subscribed calendars receiving Brotli responses. Even if it only advertises gzip, it still accepts Brotli responses.
You’ll likely want to go in and backport the latest fixes on your hosts if you have users using Roundcube.