The Brotli out-of-bounds write called Node2Shell and HTTP2Shell (CVE-2026-111497) also reaches the Python Brotli packages and curl builds with Brotli when --compressed is used. On a Windows 11 PC I checked that Python decodes br responses whatever it asks for, that pip-audit now flags it, and that Git for Windows still ships the unpatched Brotli, then updated Node.js.
