Hi,
We use Box for file sharing and are currently conducting a security assessment regarding CVE-2026-111497 (HTTP2Shell / Node2Shell).
We would appreciate a written statement from Box regarding the potential impact of this vulnerability. Specifically:
1. Does any component of the Box service use Brotli or affected components related to CVE-2026-111497, including Node.js, Bun, Python packages, Envoy, Istio, or .NET?
2. If so, is the Box service affected by CVE-2026-111497, and have the necessary security patches or mitigations been applied?
3. If remediation was required, has it been completed?
4. Has Box identified any indication of exploitation attempts related to this vulnerability against its infrastructure?
5. Is any action required from Box customers or end users?
A short written response would be appreciated. If Box has published or plans to publish a public security advisory regarding CVE-2026-111497, a link to that advisory would be sufficient.
Thank you.