PHP had to scramble last week - now it is Node's turn. Node2Shell, or Broccoli2Shell if you’re feeling leafy - RCE works in lab conditions.

It’s got three names already - Node2Shell, HTTP2Shell, Broccoli2Shell - because of course it does. Whatever you call it, same compression bug, different runtime: PHP patched its pre-auth RCE wave last week, this is ours.

• This one is quite less theoretical than PHP2Shell - PoC is working in the lab against Node 24.22.0 on x86-64, shell returned as the service account.

• Meanwhile a scanner is already out there fingerprinting which hosts decompress Brotli - building the hit list before the exploit goes wide.

• Patch to 22.23.4 / 24.22.1 / 26.12.1.