CISA Issues Alert on Ongoing Exploitation of Critical Node2Shell Vulnerability

On Tuesday, CISA reported that malicious actors are already leveraging a severe vulnerability in the Brotli compression library—known as Node2Shell and also called Broccoli2Shell and HTTP2Shell—sparking worries over remote code execution on affected machines.

The flaw stems from Brotli's processing of specially crafted inputs, which lets malicious payloads evade standard validation and cause arbitrary code execution during decompression, potentially giving attackers command of the compromised host.

Node2Shell affects a wide array of software that uses Brotli for HTTP/2 compression—such as major web servers, reverse proxies, and CDN edge nodes—so the vulnerability could touch numerous internet‑facing services that value speed.

CISA's advisory recommends that organizations promptly install vendor‑issued patches, disable Brotli where feasible, and vigilantly watch network traffic for compromise signs. It also advises refreshing intrusion‑detection signatures and using endpoint defenses that can detect unusual process activity.

This alert comes amid a recent series of disclosures about compression‑related and supply‑chain flaws that ransomware gangs and state‑aligned actors have weaponized, showing how low‑level library bugs can become entry points for larger network breaches.

Analysts point out that the rapid shift from disclosure to active exploitation highlights the urgent importance of timely patching. While no significant incidents have been publicly tied to Node2Shell so far, the agency warns that ongoing attacks could interrupt web services, jeopardize data integrity, and open the door to more advanced cyber‑espionage or ransomware operations.