CISA confirms active exploitation of critical Brotli decoder flaw
The bug, nicknamed Node2Shell, Broccoli2Shell and HTTP2Shell, was added to CISA's Known Exploited Vulnerabilities catalog with a November 10 federal patch deadline.
CISA confirmed on Tuesday that attackers have begun exploiting a critical Brotli decoder vulnerability, BleepingComputer reported on October 28. The flaw has picked up several nicknames in the industry: Node2Shell, Broccoli2Shell and HTTP2Shell.
The bug is an out-of-bounds write in the Brotli decoder, the component that expands data compressed with Google's Brotli algorithm. According to CISA, a remote unauthenticated attacker can use a crafted Brotli-compressed stream to corrupt adjacent decoder state memory, leak sensitive memory contents, cause a denial of service, or potentially run arbitrary code.
The issue was first identified in the Node.js runtime, but it also affects HTTP servers and clients that rely on vulnerable Brotli implementations. BleepingComputer reported that Microsoft pushed an emergency .NET update on Sunday, warning that the flaw could be used to escalate privileges on systems running a vulnerable .NET version.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered US federal agencies to patch by November 10 under Binding Operational Directive 26-04. That directive covers federal agencies only, but the agency urged all defenders to prioritize the fix.
For teams that can't update immediately, the reported options are blocking Brotli-compressed requests at the proxy or firewall, or disabling Brotli decoding. After patching, administrators should restart affected processes and rebuild and redeploy affected container images.
CVE references
Sources
- CISA warns of hackers now exploiting critical Node2Shell flawPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning