Sweet Security has disclosed new research findings expanding the known scope of the Node2Shell vulnerability beyond its original C implementation. Tomer Ben Gera, an engineer on Sweet Security's sensor team, identified that a parallel fix was pushed to the Go implementation of the Brotli compression library on October 23, confirming the same vulnerability class existed in Go.
Sweet Security identified a parallel fix pushed to the Go implementation of the Brotli compression library, confirming the vulnerability class existed in Go.
The Go Brotli library is a direct or indirect dependency of major HTTP frameworks including Traefik, Fiber and Iris, with combined GitHub adoption exceeding 130,000 stars.
Traefik uses the library as a direct dependency in its Compress middleware, with over one billion cumulative Docker pulls.
Fiber carries an indirect dependency through fasthttp v2.52.9, with request-body decoding exposed through Ctx.Body() and JSON BodyParser.
Iris carries the library as a direct dependency with support for both response encoding and request decoding.
Dependency presence alone does not establish vulnerability or reachability; versions, encoder versus decoder usage and configuration all affect exposure.
"The simultaneous fix across both C and Go implementations is a strong signal that the vulnerability class is not language-specific," said Tomer Ben Gera, Sensor Team Engineer, Sweet Security. "Where there is a fix in Go, there was a problem in Go. Security teams that have focused remediation efforts on their Node and PHP environments need to extend that assessment to their Go-based HTTP infrastructure."
The Go Brotli library fix, pushed approximately two days ago alongside the original C remediation, indicates the underlying memory-management flaw present in the C implementation was replicated in Go. Sweet Security's analysis identified four major Go HTTP projects with confirmed dependency on the affected library:
Traefik, with over 65,000 GitHub stars and more than one billion cumulative Docker pulls, uses the library as a direct dependency in its Compress middleware for encoding outgoing Brotli responses.
Fiber, with over 40,000 stars, carries an indirect dependency through fasthttp in v2.52.9, with request-body decoding exposed through Ctx.Body() and JSON BodyParser, creating a path where client-controlled compressed bodies could trigger the vulnerability.
Iris, with over 25,000 stars, carries the library as a direct dependency with support for both response encoding and request decoding.
fasthttp, with over 23,000 stars, carried the library as a direct dependency through v1.73.0 before migrating to an alternative in v1.74.0.
Sweet Security notes that dependency presence alone does not establish vulnerability or reachability. Organizations should verify which version of the library is in use and whether Brotli decoding of client-controlled input is enabled in their specific configuration.
The expansion of Node2Shell to Go-based HTTP infrastructure means organizations running Traefik as a reverse proxy or load balancer, applications built on Fiber or Iris, and any Go HTTP service using Brotli request decompression should treat this as an active area of investigation.
Traditional vulnerability scanners face a structural limitation in assessing this class of vulnerability. Because Node and Go binaries do not follow predictable installation paths, scanners that rely on known paths and package registries may not detect the presence of the vulnerable library. Runtime visibility, which identifies what is actually executing, is required to accurately assess exposure.
Sweet Security recommends organizations immediately inventory Go-based HTTP services for Brotli library dependencies, verify library versions against the patched releases, assess whether client-controlled Brotli decoding is enabled, and monitor runtime behavior for signs of exploitation including unexpected process execution, unusual outbound connections, and abnormal memory behavior in HTTP worker processes.
Sweet Security is continuing to monitor both Node2Shell and the broader HTTP2Shell vulnerability class and will provide updated detection guidance and indicators of compromise as the situation develops.
