PHP had to scramble last week - now it is Node's turn. Node2Shell, or Broccoli2Shell if you’re feeling leafy - RCE works in lab conditions.

[u/HexLayer3]

https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/

It’s got three names already - Node2Shell, HTTP2Shell, Broccoli2Shell - because of course it does. Whatever you call it, same compression bug, different runtime: PHP patched its pre-auth RCE wave last week, this is ours.

• This one is quite less theoretical than PHP2Shell - PoC is working in the lab against Node 24.22.0 on x86-64, shell returned as the service account.
• Meanwhile a scanner is already out there fingerprinting which hosts decompress Brotli - building the hit list before the exploit goes wide.
• Patch to 22.23.4 / 24.22.1 / 26.12.1.

[u/rusbon]

Broccoli? xD

[u/eternal-son]

Do we blame AI for this one too?

[u/HexLayer3 → u/eternal-son]

Reported by OpenAI Codex Security, Khai Tran and Sylvie Mayer

[u/Chenz]

This is last week’s news, no? Every serious actor should be patched by now

[u/h0uz3_]

When I first heard of that, I checked mu build pipelines that were still on Node 20. Opened up the path for upgrading to newer Vue and Vite versions.

Always look on the bright side! :)

[u/mmomtchev]

People still on 18 or 20 will have to upgrade. These are vulnerable too.

However if you use HTTP reverse proxy in front of your Node, it is the reverse proxy that will get hit.

Node is usually a standalone installation built with static brotli, however the HTTP server is usually part of the OS and it is built with the system version of brotli.

I very often block POST requests (unless the site requires them), the attack is very difficult without POST - you will have to trick the remote server to download brotli-compressed data.

[u/thrumyshadow2]

Considering many PHP servers are on Linux, and use libcurl (which is usually compiled with Brotli out of the box) its still PHP's turn.

[u/breadgolemwaifu → u/thrumyshadow2]

PHP: I'm tired, boss...

[u/landline_number]

I question the node.js team's decision to release 24.22.0 a week before 24.22.1. I want to expedite these security fixes to production ASAP but need to be cautious because of the changes in 24.22.0.

For example, here's a regression in v24.22.0.

https://github.com/nodejs/node/issues/66781

I think they should have released these fixes as 24.21.1 and then released 24.22.0 afterwards.

[u/adevx]

I have an automated daily patch routine, with today's tooling these cve's should be a footnote in your daily update summary.

[u/HexLayer3 → u/adevx]

The trick is to patch fast enough to not get RCEd, while slow enough to not get supply chain compromised.

[u/adevx → u/HexLayer3]

For sure, only high severity updates can bypass the cooldown period. 

[u/whatisboom]

AI Slop

[u/lurkingtonbear → u/whatisboom]

I wish people who commented AI Slop like this would get banned from Reddit. You contribute nothing here. This information is helpful and your comment does not contribute to the conversation. It does not matter whether the post was created by AI.

[u/itsmegoddamnit → u/lurkingtonbear]

That’s exactly what an apologetic bot would say

[u/Sulungskwa → u/lurkingtonbear]

This comment was much more useful than yours. It matters very much to me whether someone has the decency to write something out for me to read or just run it through a sloppifier.

[u/AntDracula → u/lurkingtonbear]

AI slop

[u/HexLayer3 → u/lurkingtonbear]

I am quite real and sleep-deprived. This one is not as bad as React2Shell but with working RCE it is really time to patch.

Given this is October - are you aware of Cybersecurity yet? /s

[u/HexLayer3 → u/whatisboom]

Exploit chain and vulnerability is quite real