# Http2shell | Brotli, Roundcube, and Nextcloud

**URL:** <https://discourse.mailinabox.email/t/http2shell-brotli-roundcube-and-nextcloud/17096>\
**Category:** Maintenance\
**Created:** [October 24, 2026, 10:07am UTC](https://discourse.mailinabox.email/t/http2shell-brotli-roundcube-and-nextcloud/17096 "2026-10-24T10:07:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Greg](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/greg/32/924_2.png) [@Greg](https://discourse.mailinabox.email/u/Greg)\
**Post date:** [October 24, 2026, 10:07am UTC](https://discourse.mailinabox.email/t/http2shell-brotli-roundcube-and-nextcloud/17096/1 "2026-10-24T10:07:03Z")

</div>

CVE-2026-111497 was recently renamed from _node_2shell to _http_2shell as it’s Brotli that’s affected, not necessarily just Node.js.

Roundcube packages Brotli 1.0.9 even in the latest MIAB v78, and can fetch remote stylesheets while displaying HTML emails, decompressing responses before validating the CSS.  
There’s also a Nextcloud path via subscribed calendars receiving Brotli responses. Even if it only advertises gzip, it still accepts Brotli responses.

You’ll likely want to go in and backport the latest fixes on your hosts if you have users using Roundcube.