Sweet Security Research Identifies Go Implementation of Node2Shell Vulnerability, Expanding Attack Surface to Major HTTP Frameworks

Sweet Security engineer discovers fix pushed to Go Brotli library, confirming vulnerability existed across language implementations; Traefik, Fiber, and Iris among affected frameworks

TEL AVIV, Israel, Oct. 25, 2026 (GLOBE NEWSWIRE) -- Sweet Security today disclosed new research findings expanding the known scope of the Node2Shell vulnerability beyond its original C implementation. Tomer Ben Gera, an engineer on Sweet Security’s sensor team, identified that a parallel fix was pushed to the Go implementation of the Brotli compression library on October 23, confirming the same vulnerability class existed in Go.

The finding significantly expands the potential attack surface. The Go Brotli library is a direct or indirect dependency of several major HTTP frameworks, including Traefik, Fiber, and Iris, with combined GitHub adoption exceeding 130,000 stars and Traefik alone accumulating over one billion cumulative Docker image pulls.

“The simultaneous fix across both C and Go implementations is a strong signal that the vulnerability class is not language-specific,” said Tomer Ben Gera, Sensor Team Engineer, Sweet Security. “Where there is a fix in Go, there was a problem in Go. Security teams that have focused remediation efforts on their Node and PHP environments need to extend that assessment to their Go-based HTTP infrastructure.”

Key Findings

The Go Brotli library fix, pushed approximately two days ago alongside the original C remediation, indicates the underlying memory-management flaw present in the C implementation was replicated in Go. Sweet Security’s analysis identified four major Go HTTP projects with confirmed dependency on the affected library:

• Traefik, with over 65,000 GitHub stars and more than one billion cumulative Docker pulls, uses the library as a direct dependency in its Compress middleware for encoding outgoing Brotli responses.
• Fiber, with over 40,000 stars, carries an indirect dependency through fasthttp in v2.52.9, with request-body decoding exposed through Ctx.Body() and JSON BodyParser, creating a path where client-controlled compressed bodies could trigger the vulnerability.
• Iris, with over 25,000 stars, carries the library as a direct dependency with support for both response encoding and request decoding.
• fasthttp, with over 23,000 stars, carried the library as a direct dependency through v1.73.0 before migrating to an alternative in v1.74.0.
  
  

Sweet Security notes that dependency presence alone does not establish vulnerability or reachability. Versions, encoder versus decoder usage, and application-level configuration all affect actual exposure. Organizations should verify which version of the library is in use and whether Brotli decoding of client-controlled input is enabled in their specific configuration.

Implications for Security Teams

The expansion of Node2Shell to Go-based HTTP infrastructure means organizations running Traefik as a reverse proxy or load balancer, applications built on Fiber or Iris, and any Go HTTP service using Brotli request decompression should treat this as an active area of investigation rather than a future concern.

Traditional vulnerability scanners face a structural limitation in assessing this class of vulnerability. Because Node and Go binaries do not follow predictable installation paths, scanners that rely on known paths and package registries may not detect the presence of the vulnerable library. Runtime visibility, which identifies what is actually executing rather than what is expected to be present, is required to accurately assess exposure.

Sweet Security recommends organizations immediately inventory Go-based HTTP services for Brotli library dependencies, verify library versions against the patched releases, assess whether client-controlled Brotli decoding is enabled, and monitor runtime behavior for signs of exploitation including unexpected process execution, unusual outbound connections, and abnormal memory behavior in HTTP worker processes.

Sweet Security is continuing to monitor both Node2Shell and the broader HTTP2Shell vulnerability class and will provide updated detection guidance and indicators of compromise as the situation develops.

To learn more, read Sweet Security’s research blog on the Node2Shell vulnerability and how it extends beyond the original C implementation.

Media Contacts:

Noa Glumcher
VP Marketing, Sweet Security
noag@sweet.security

Chloe Amante
Montner Tech PR
camante@montner.com

A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/4e0ebb6c-0f63-4b7a-8a01-500c8690deb9

Sweet Security Research Identifies Go Implementation of Node2Shell Vulnerability, Expanding Attack Surface to Major HTTP Frameworks

Sweet Security engineer discovers fix pushed to Go Brotli library, confirming vulnerability existed across language implementations; Traefik, Fiber, and Iris among affected frameworks