Sweet Security Research Identifies Go Implementation of Node2Shell Vulnerability, Expanding Attack Surface to Major HTTP Frameworks

Sweet Secu ity e gi ee discove s fix pushed to Go B otli lib a y, co fi mi g vul e ability existed ac oss la guage impleme tatio s; T aefik, Fibe , a d I is amo g affected f amewo ks

TEL AVIV, Is ael, Oct. 25, 2026 (GLOBE NEWSWIRE) — Sweet Secu ity today disclosed ew esea ch fi di gs expa di g the k ow scope of the Node2Shell vul e ability beyo d its o igi al C impleme tatio . Tome Be Ge a, a e gi ee o Sweet Secu ity’s se so team, ide tified that a pa allel fix was pushed to the Go impleme tatio of the B otli comp essio lib a y o Octobe 23, co fi mi g the same vul e ability class existed i Go.

The fi di g sig ifica tly expa ds the pote tial attack su face. The Go B otli lib a y is a di ect o i di ect depe de cy of seve al majo HTTP f amewo ks, i cludi g T aefik, Fibe , a d I is, with combi ed GitHub adoptio exceedi g 130,000 sta s a d T aefik alo e accumulati g ove o e billio cumulative Docke image pulls.

“The simulta eous fix ac oss both C a d Go impleme tatio s is a st o g sig al that the vul e ability class is ot la guage-specific,” said Tome Be Ge a, Se so Team E gi ee , Sweet Secu ity. “Whe e the e is a fix i Go, the e was a p oblem i Go. Secu ity teams that have focused emediatio effo ts o thei Node a d PHP e vi o me ts eed to exte d that assessme t to thei Go-based HTTP i f ast uctu e.”

Key Fi di gs

The Go B otli lib a y fix, pushed app oximately two days ago alo gside the o igi al C emediatio , i dicates the u de lyi g memo y-ma ageme t flaw p ese t i the C impleme tatio was eplicated i Go. Sweet Secu ity’s a alysis ide tified fou majo Go HTTP p ojects with co fi med depe de cy o the affected lib a y:

• T aefik, with ove 65,000 GitHub sta s a d mo e tha o e billio cumulative Docke pulls, uses the lib a y as a di ect depe de cy i its Comp ess middlewa e fo e codi g outgoi g B otli espo ses.
• Fibe , with ove 40,000 sta s, ca ies a i di ect depe de cy th ough fasthttp i v2.52.9, with equest-body decodi g exposed th ough Ctx.Body() a d JSON BodyPa se , c eati g a path whe e clie t-co t olled comp essed bodies could t igge the vul e ability.
• I is, with ove 25,000 sta s, ca ies the lib a y as a di ect depe de cy with suppo t fo both espo se e codi g a d equest decodi g.
• fasthttp, with ove 23,000 sta s, ca ied the lib a y as a di ect depe de cy th ough v1.73.0 befo e mig ati g to a alte ative i v1.74.0.

Sweet Secu ity otes that depe de cy p ese ce alo e does ot establish vul e ability o eachability. Ve sio s, e code ve sus decode usage, a d applicatio -level co figu atio all affect actual exposu e. O ga izatio s should ve ify which ve sio of the lib a y is i use a d whethe B otli decodi g of clie t-co t olled i put is e abled i thei specific co figu atio .

Implicatio s fo Secu ity Teams

The expa sio of Node2Shell to Go-based HTTP i f ast uctu e mea s o ga izatio s u i g T aefik as a eve se p oxy o load bala ce , applicatio s built o Fibe o I is, a d a y Go HTTP se vice usi g B otli equest decomp essio should t eat this as a active a ea of i vestigatio athe tha a futu e co ce .

T aditio al vul e ability sca e s face a st uctu al limitatio i assessi g this class of vul e ability. Because Node a d Go bi a ies do ot follow p edictable i stallatio paths, sca e s that ely o k ow paths a d package egist ies may ot detect the p ese ce of the vul e able lib a y. Ru time visibility, which ide tifies what is actually executi g athe tha what is expected to be p ese t, is equi ed to accu ately assess exposu e.

Sweet Secu ity ecomme ds o ga izatio s immediately i ve to y Go-based HTTP se vices fo B otli lib a y depe de cies, ve ify lib a y ve sio s agai st the patched eleases, assess whethe clie t-co t olled B otli decodi g is e abled, a d mo ito u time behavio fo sig s of exploitatio i cludi g u expected p ocess executio , u usual outbou d co ectio s, a d ab o mal memo y behavio i HTTP wo ke p ocesses.

Sweet Secu ity is co ti ui g to mo ito both Node2Shell a d the b oade HTTP2Shell vul e ability class a d will p ovide updated detectio guida ce a d i dicato s of comp omise as the situatio develops.

To lea mo e, ead Sweet Secu ity’s esea ch blog o the Node2Shell vul e ability a d how it exte ds beyo d the o igi al C impleme tatio .

Media Co tacts:

Noa Glumche VP Ma keti g, Sweet Secu ity oag@sweet.secu ity

Chloe Ama teMo t e Tech PRcama te@mo t e .com

A photo accompa yi g this a ou ceme t is available at https://www.globe ewswi e.com/NewsRoom/Attachme tNg/4e0ebb6c-0f63-4b7a-8a01-500c8690deb9