{"id":118175,"date":"2026-10-26T14:56:31","date_gmt":"2026-10-26T06:56:31","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/118175.html"},"modified":"2026-10-26T14:56:31","modified_gmt":"2026-10-26T06:56:31","slug":"http2shell-%e6%bc%8f%e6%b4%9e-cve-2026-111497%ef%bc%9a5-%e5%88%86%e9%92%9f%e6%8e%92%e6%9f%a5-node-js-python-bun-envoy-%e6%98%af%e5%90%a6%e5%8f%97%e5%bd%b1%e5%93%8d","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/118175.html","title":{"rendered":"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd"},"content":{"rendered":"

HTTP2Shell \u6f0f\u6d1e CVE-2026-111497：5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd<\/p>\n

10 \u6708 21 \u65e5，Node.js \u9879\u76ee\u53d1\u5e03\u5b89\u5168\u66f4\u65b0，\u4fee\u590d\u4e86\u4e00\u4e2a Brotli \u89e3\u7801\u5668\u4e2d\u7684\u4e25\u91cd\u5185\u5b58\u5b89\u5168\u6f0f\u6d1e\u3002\u8fd9\u4e2a\u6f0f\u6d1e（CVE-2026-111497，CVSS 9.2）\u7684\u5f71\u54cd\u8303\u56f4\u8fdc\u8d85 Node.js：Python \u7684 brotli\/brotlicffi \u5305\u3001Bun\u3001Envoy \u4ee3\u7406\u3001Istio \u670d\u52a1\u7f51\u683c，\u4ee5\u53ca\u4efb\u4f55\u5185\u5d4c\u53d7\u5f71\u54cd Brotli \u89e3\u7801\u5668\u7684 HTTP \u5ba2\u6237\u7aef\u6216\u670d\u52a1\u7aef，\u90fd\u53ef\u80fd\u88ab\u653b\u51fb\u8005\u901a\u8fc7\u7279\u5236\u538b\u7f29\u6570\u636e\u89e6\u53d1\u8d8a\u754c\u5199\u5165，\u5bfc\u81f4\u5185\u5b58\u6cc4\u9732\u3001\u8fdb\u7a0b\u5d29\u6e83\u751a\u81f3\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002<\/p>\n

TL;DR：\u8fd0\u884c\u7b2c\u4e09\u8282\u6392\u67e5\u547d\u4ee4，5 \u5206\u949f\u786e\u8ba4\u670d\u52a1\u662f\u5426\u53d7\u5f71\u54cd；\u53d7\u5f71\u54cd\u5c31\u6309\u7b2c\u56db\u8282\u5347\u7ea7，\u65e0\u6cd5\u7acb\u5373\u5347\u7ea7\u5148\u4e0a 4.3 \u4e34\u65f6\u7f13\u89e3\u3002<\/p>\n

\u4e00\u300130 \u79d2\u4e86\u89e3\u6f0f\u6d1e<\/h3>\n

Google Brotli \u538b\u7f29\u5e93（1.0.3 \u2013 1.2.0）\u7684\u89e3\u7801\u5668\u5728 DecodeBlockTypeAndLength() \u51fd\u6570\u4e2d\u5b58\u5728\u8fd4\u56de\u503c\u8bed\u4e49\u6df7\u6dc6：\u8c03\u7528\u65b9\u65e0\u6cd5\u533a\u5206\u300c\u8f93\u5165\u8017\u5c3d\u300d\u4e0e\u300c\u6570\u636e\u6d41\u975e\u6cd5\u300d\u3002\u653b\u51fb\u8005\u6784\u9020\u4e00\u6761\u7279\u5236\u7684 Brotli \u538b\u7f29\u6d41，\u5373\u53ef\u89e6\u53d1\u8d8a\u754c\u5199\u5165，\u7834\u574f\u76f8\u90bb\u5185\u5b58\u6570\u636e\u3002<\/p>\n

\u7531\u4e8e Brotli \u662f HTTP\/1.1 \u548c HTTP\/2 \u7684\u901a\u7528\u538b\u7f29\u6807\u51c6（Content-Encoding: br），\u4efb\u4f55\u89e3\u538b\u4e0d\u53ef\u4fe1 Brotli \u6570\u636e\u7684\u670d\u52a1\u90fd\u53ef\u80fd\u53d7\u5f71\u54cd\u3002<\/p>\n

\u4e8c\u3001\u4f60\u7684\u670d\u52a1\u53d7\u5f71\u54cd\u5417？<\/h3>\n\n\u7ec4\u4ef6\u53d7\u5f71\u54cd\u7248\u672c\u4fee\u590d\u7248\u672c\u5f71\u54cd\u7b49\u7ea7<\/tr>\n\n\n\n\n\n\n
Google Brotli（C \u5e93）<\/td>\n1.0.3 \u2013 1.2.0<\/td>\n\u2265 1.2.1<\/td>\n\u26a0\ufe0f \u9ad8<\/td>\n<\/tr>\n
Node.js<\/td>\n22.x \/ 24.x \/ 26.x \u6d3b\u8dc3\u53d1\u5e03\u7ebf<\/td>\n10-21 \u5b89\u5168\u66f4\u65b0\u540e\u7248\u672c<\/td>\n\u26a0\ufe0f \u9ad8<\/td>\n<\/tr>\n
Bun<\/td>\n< 1.4.4<\/td>\n\u2265 1.4.4<\/td>\n\u26a0\ufe0f \u9ad8<\/td>\n<\/tr>\n
Python brotli \/ brotlicffi<\/td>\n\u5185\u5d4c\u53d7\u5f71\u54cd Brotli \u7684\u7248\u672c<\/td>\n\u5347\u7ea7\u5230\u6700\u65b0\u7248<\/td>\n\u26a0\ufe0f \u4e2d\u9ad8<\/td>\n<\/tr>\n
Envoy \/ Istio<\/td>\n\u542f\u7528 Brotli \u538b\u7f29\u7684\u53d7\u5f71\u54cd\u6784\u5efa<\/td>\n\u5347\u7ea7 Envoy \u4fee\u590d\u7248<\/td>\n\u26a0\ufe0f \u4e2d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u5224\u65ad\u903b\u8f91：\u53ea\u8981\u4f60\u7684\u670d\u52a1\u4f1a\u89e3\u538b\u5916\u90e8\u4f20\u5165\u7684 Brotli \u6570\u636e（\u4f5c\u4e3a\u670d\u52a1\u7aef\u6536\u8bf7\u6c42\u3001\u6216\u4f5c\u4e3a\u5ba2\u6237\u7aef\u6536\u54cd\u5e94），\u5c31\u6309\u7b2c\u4e09\u8282\u6392\u67e5\u3002<\/p>\n

\u4e09\u30015 \u5206\u949f\u6392\u67e5\u6e05\u5355<\/h3>\n

3.1 Node.js<\/h4>\n

# \u770b\u8fd0\u884c\u65f6\u7248\u672c（22.x \/ 24.x \/ 26.x \u90fd\u5728\u5f71\u54cd\u8303\u56f4\u5185）<\/span>
\nnode<\/span> -v<\/span><\/p>\n

# \u770b Node \u5185\u5d4c\u7684 Brotli \u5e93\u7248\u672c<\/span>
\nnode<\/span> -p<\/span> "process.versions.brotli"<\/span><\/p>\n

# \u9879\u76ee\u4f9d\u8d56\u91cc\u6709\u6ca1\u6709\u76f4\u63a5\u7528 brotli \u7684\u5305<\/span>
\nnpm<\/span> ls<\/span> brotli 2<\/span>><\/span>\/dev\/null<\/p>\n

\u7ed3\u8bba：Node.js \u672c\u4f53\u53d7\u5f71\u54cd，\u76f4\u63a5\u6309 4.2 \u5347\u7ea7\u5230 10 \u6708 21 \u65e5\u5b89\u5168\u7248\u672c，\u4e0d\u8981\u505c\u7559\u5728\u65e7\u6d3b\u8dc3\u7ebf\u3002<\/p>\n

3.2 Python<\/h4>\n

# \u67e5\u662f\u5426\u5b89\u88c5\u4e86 Brotli \u76f8\u5173\u5305<\/span>
\npip list |<\/span> grep<\/span> -i<\/span> brotli<\/p>\n

# \u7528 pip-audit \u626b\u4e00\u904d（\u6ce8\u610f：\u81ea\u52a8\u5de5\u5177\u53ef\u80fd\u4e0d\u4f1a\u6807\u8bb0\u6b64 CVE，\u522b\u53ea\u4fe1\u626b\u63cf\u5668）<\/span>
\npip-audit<\/p>\n

3.3 Bun<\/h4>\n

bun –version<\/span> # < 1.4.4 \u5373\u53d7\u5f71\u54cd<\/span><\/p>\n

3.4 Envoy \/ Istio<\/h4>\n

# \u770b Envoy \u7248\u672c（\u5bf9\u7167 Envoy \u5b98\u65b9\u4fee\u590d\u516c\u544a）<\/span>
\nenvoy –version<\/span><\/p>\n

# \u68c0\u67e5 Istio sidecar \u6ce8\u5165\u7684 Envoy \u7248\u672c<\/span>
\nkubectl get pods -n<\/span> istio-system -o<\/span> jsonpath<\/span>=<\/span>"{..image}"<\/span> |<\/span> tr<\/span> ' '<\/span> '\\\\n'<\/span> |<\/span> grep<\/span> proxyv2 |<\/span> sort<\/span> -u<\/span><\/p>\n

# \u68c0\u67e5\u662f\u5426\u542f\u7528\u4e86 Brotli \u538b\u7f29\u914d\u7f6e<\/span>
\nkubectl get configmap -n<\/span> istio-system istio-sidecar-injector -o<\/span> yaml |<\/span> grep<\/span> -i<\/span> brotli<\/p>\n

\u56db\u3001\u4fee\u590d\u65b9\u6848<\/h3>\n

4.1 \u5347\u7ea7\u7cfb\u7edf Brotli \u5e93<\/h4>\n

# macOS<\/span>
\nbrew upgrade brotli<\/p>\n

# Ubuntu \/ Debian<\/span>
\nsudo<\/span> apt<\/span> update &&<\/span> sudo<\/span> apt<\/span> upgrade libbrotli1<\/p>\n

# CentOS \/ RHEL<\/span>
\nsudo<\/span> yum update brotli<\/p>\n

4.2 \u5347\u7ea7\u8fd0\u884c\u65f6<\/h4>\n

# Node.js：\u5347\u7ea7\u5230 10-21 \u5b89\u5168\u516c\u544a\u5bf9\u5e94\u7248\u672c（\u5404\u6d3b\u8dc3\u7ebf\u6700\u65b0）<\/span>
\nnvm install<\/span> –lts<\/span> &&<\/span> nvm use –lts<\/span><\/p>\n

# Bun：\u2265 1.4.4<\/span>
\nbun upgrade<\/p>\n

# Python：\u5347\u7ea7 Brotli \u5305（\u786e\u8ba4\u5e95\u5c42\u7cfb\u7edf\u5e93\u4e5f\u5df2\u66f4\u65b0）<\/span>
\npip install<\/span> –upgrade<\/span> brotli brotlicffi<\/p>\n

4.3 \u4e34\u65f6\u7f13\u89e3（\u65e0\u6cd5\u7acb\u5373\u5347\u7ea7\u65f6）<\/h4>\n

# Nginx：\u62d2\u7edd Brotli \u538b\u7f29\u7684\u5165\u7ad9\u8bf7\u6c42
\nif ($http_content_encoding ~* "br") {
\n return 406;
\n}<\/p>\n

# \u5728\u53cd\u5411\u4ee3\u7406\u5c42\u5265\u79bb\u538b\u7f29\u534f\u5546\u5934
\nproxy_set_header Accept-Encoding "";<\/p>\n

\u4e94\u3001\u9a8c\u8bc1\u4fee\u590d<\/h3>\n

# Brotli \u5e93\u7248\u672c \u2265 1.2.1<\/span>
\nbrew list –versions<\/span> brotli # macOS<\/span>
\ndpkg -l<\/span> |<\/span> grep<\/span> brotli # Ubuntu<\/span><\/p>\n

# Node.js \/ Bun \u7248\u672c<\/span>
\nnode<\/span> -v<\/span> &&<\/span> node<\/span> -p<\/span> "process.versions.brotli"<\/span>
\nbun –version<\/span><\/p>\n

# \u786e\u8ba4\u65e0 Brotli \u89e3\u538b\u914d\u7f6e\u66b4\u9732<\/span>
\ngrep<\/span> -r<\/span> "Content-Encoding: br"<\/span> \/etc\/nginx\/ 2<\/span>><\/span>\/dev\/null<\/p>\n

\u516d\u3001\u5f71\u54cd\u8303\u56f4\u4e0e\u80cc\u666f<\/h3>\n

\u8fd9\u4e2a\u6f0f\u6d1e\u6700\u521d\u56e0 Node.js \u5229\u7528\u8def\u5f84\u88ab\u79f0\u4e3a\u300cNode2Shell\u300d，\u540e\u56e0\u5f71\u54cd\u9762\u6269\u5927（Python\u3001Bun\u3001Envoy\u3001Istio \u7b49）\u6f14\u53d8\u4e3a\u300cHTTP2Shell\u300d\u3002OpenAI Codex Security \u56e2\u961f\u7684 Khai Tran \u548c Sylvie Mayer \u53d1\u73b0\u4e86\u6839\u89e3\u6790\u5668\u7f3a\u9677，Node.js \u7ef4\u62a4\u8005 Matteo Collina \u548c Antoine du Hamel \u5b8c\u6210\u4e86\u4fee\u590d\u3002<\/p>\n

Google \u5c06\u6f0f\u6d1e\u8bc4\u4e3a CVSS 9.2（\u4e25\u91cd），Red Hat \u8bc4\u4e3a 8.1，Node.js \u6807\u6ce8 high\u3002\u622a\u81f3\u76ee\u524d\u5c1a\u672a\u62a5\u544a\u5728\u91ce\u5229\u7528\u2014\u2014\u4f46\u5b89\u5168\u793e\u533a\u5df2\u6709 PoC，\u4fee\u590d\u7a97\u53e3\u6709\u9650\u3002<\/p>\n

\u4e03\u3001\u7ed9\u5f00\u53d1\u8005\u7684\u9884\u9632\u5efa\u8bae<\/h3>\n
    \n
  • CI\/CD \u96c6\u6210\u626b\u63cf：pipeline \u91cc\u52a0\u5165 pip-audit\u3001npm audit\u3001bun audit；\u4f46\u6ce8\u610f\u81ea\u52a8\u5316\u5de5\u5177\u53ef\u80fd\u4e0d\u4f1a\u6807\u8bb0\u6b64 CVE（PyPI \u5305\u6620\u5c04\u7f3a\u5931），\u4e0d\u80fd\u53ea\u4fe1\u626b\u63cf\u5668<\/li>\n
  • SBOM \u7ba1\u7406：\u7ef4\u62a4\u8f6f\u4ef6\u7269\u6599\u6e05\u5355，\u786e\u4fdd\u80fd\u5feb\u901f\u5b9a\u4f4d\u6240\u6709\u4f7f\u7528 Brotli \u89e3\u7801\u5668\u7684\u670d\u52a1<\/li>\n
  • \u6700\u5c0f\u5316\u538b\u7f29\u652f\u6301：\u975e\u4e1a\u52a1\u9700\u8981，\u670d\u52a1\u7aef\u4e0d\u4e3b\u52a8\u534f\u5546 Content-Encoding: br<\/li>\n
  • \u5173\u6ce8\u540e\u7eed\u901a\u62a5：CISA \u76ee\u524d\u8bc4\u4f30\u5728\u91ce\u5229\u7528\u4e3a none，\u4f46 PoC \u5df2\u516c\u5f00\u2014\u2014\u4fee\u590d\u7a97\u53e3\u6709\u9650，\u522b\u62d6<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

    HTTP2Shell \u6f0f\u6d1e CVE-2026-111497：5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd
    \n10 \u6708 21 \u65e5，Node.js \u9879\u76ee\u53d1\u5e03\u5b89\u5168\u66f4\u65b0，\u4fee\u590d\u4e86\u4e00\u4e2a Brotli \u89e3\u7801\u5668\u4e2d\u7684\u4e25\u91cd\u5185\u5b58\u5b89\u5168\u6f0f\u6d1e\u3002\u8fd9\u4e2a\u6f0f\u6d1e（CVE-2026-111497，CVSS 9.2）\u7684\u5f71\u54cd\u8303\u56f4\u8fdc\u8d85 Node.js：Python \u7684 brotli\/brotlic<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[186,81,190],"topic":[],"class_list":["post-118175","post","type-post","status-publish","format-standard","hentry","category-server","tag-node-js","tag-python","tag-190"],"yoast_head":"\nHTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/118175.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497：5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd 10 \u6708 21 \u65e5，Node.js \u9879\u76ee\u53d1\u5e03\u5b89\u5168\u66f4\u65b0，\u4fee\u590d\u4e86\u4e00\u4e2a Brotli \u89e3\u7801\u5668\u4e2d\u7684\u4e25\u91cd\u5185\u5b58\u5b89\u5168\u6f0f\u6d1e\u3002\u8fd9\u4e2a\u6f0f\u6d1e（CVE-2026-111497，CVSS 9.2）\u7684\u5f71\u54cd\u8303\u56f4\u8fdc\u8d85 Node.js：Python \u7684 brotli\/brotlic\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/118175.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-26T06:56:31+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/118175.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/118175.html\",\"name\":\"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-10-26T06:56:31+00:00\",\"dateModified\":\"2026-10-26T06:56:31+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/118175.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/118175.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/118175.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/118175.html","og_locale":"zh_CN","og_type":"article","og_title":"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497：5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd 10 \u6708 21 \u65e5，Node.js \u9879\u76ee\u53d1\u5e03\u5b89\u5168\u66f4\u65b0，\u4fee\u590d\u4e86\u4e00\u4e2a Brotli \u89e3\u7801\u5668\u4e2d\u7684\u4e25\u91cd\u5185\u5b58\u5b89\u5168\u6f0f\u6d1e\u3002\u8fd9\u4e2a\u6f0f\u6d1e（CVE-2026-111497，CVSS 9.2）\u7684\u5f71\u54cd\u8303\u56f4\u8fdc\u8d85 Node.js：Python \u7684 brotli\/brotlic","og_url":"https:\/\/www.wsisp.com\/helps\/118175.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-10-26T06:56:31+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"2 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/118175.html","url":"https:\/\/www.wsisp.com\/helps\/118175.html","name":"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-10-26T06:56:31+00:00","dateModified":"2026-10-26T06:56:31+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/118175.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/118175.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/118175.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"HTTP2Shell \u6f0f\u6d1e CVE-2026-111497\uff1a5 \u5206\u949f\u6392\u67e5 Node.js\/Python\/Bun\/Envoy \u662f\u5426\u53d7\u5f71\u54cd"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/118175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=118175"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/118175\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=118175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=118175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=118175"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=118175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}