CISA Warns of Ongoing Exploitation of Critical Node2Shell Bug

On Tuesday, CISA announced that malicious actors are already leveraging a severe vulnerability in the Brotli compression library—known as Node2Shell and also called Broccoli2Shell or HTTP2Shell—sparking worries about remote code execution on affected machines.

The flaw stems from Brotli’s processing of specially crafted inputs, which lets malicious payloads slip past standard validation and execute arbitrary code during decompression, potentially giving attackers command of the compromised host.

Node2Shell affects a wide range of software that uses Brotli for HTTP/2 compression—such as widely deployed web servers, reverse proxies, and CDN edge nodes—so the vulnerability could touch numerous internet‑facing services that value speed.

CISA’s advisory recommends that organizations promptly install any vendor‑released patches, disable Brotli where feasible, and vigilantly watch network traffic for signs of compromise. It also advises updating IDS signatures and using endpoint security tools that can detect abnormal process activity.

This alert comes amid a recent spate of disclosures about compression‑related and supply‑chain flaws that ransomware gangs and state‑aligned groups have weaponized, demonstrating how bugs in low‑level libraries can become entry points for larger network breaches.

Analysts point out that the rapid shift from public disclosure to active exploitation highlights the urgent importance of timely patching. While no high‑profile incidents have yet been tied to Node2Shell, the agency warns that ongoing attacks could knock out web services, jeopardize data integrity, and set the stage for more advanced cyber‑espionage or ransomware operations.