US Agency Alerts on Active Exploitation of Critical Node2Shell Vulnerability

CISA confirmed on Tuesday that threat actors are actively exploiting a critical flaw in the Brotli compression library, identified as Node2Shell and also referenced as Broccoli2Shell and HTTP2Shell, raising concerns about remote code execution on vulnerable systems.

The weakness originates from how Brotli handles specially crafted inputs, allowing malicious data to bypass normal validation and trigger arbitrary code execution when decompressed, potentially granting attackers control over the target host.

Node2Shell impacts a broad set of applications that rely on Brotli for HTTP/2 compression, including popular web servers, reverse proxies and content‑delivery network edge nodes, meaning the exposure could affect many internet‑facing services that prioritize performance.

In its advisory, CISA urges organizations to apply available vendor patches without delay, consider disabling Brotli where practical, and closely monitor network traffic for indicators of compromise. The agency also recommends updating intrusion‑detection signatures and deploying endpoint protections capable of spotting anomalous process behavior.

The warning follows a recent wave of disclosures highlighting compression‑related and supply‑chain vulnerabilities that have been weaponized by ransomware groups and state‑aligned actors, illustrating how low‑level library bugs can serve as footholds for broader network intrusion.

Security analysts note that the swift move from disclosure to active exploitation underscores the critical need for prompt patch management. Although no major incidents have been publicly linked to Node2Shell yet, the agency cautions that continued attacks could disrupt web services, compromise data integrity, and pave the way for more sophisticated cyber‑espionage or ransomware campaigns.