Sweet Security Warns Go Brotli Flaw May Affect Major HTTP Frameworks

Sweet Security disclosed research on October 25 linking the Node2Shell vulnerability to a Go implementation of the Brotli compression library. The Israeli cybersecurity company said engineer Tomer Ben Gera identified the Go issue and an October 23 fix. Its review found direct or indirect library dependencies in Traefik, Fiber, Iris and fasthttp. The company cautioned that a dependency alone does not establish that a system is vulnerable or that an attacker can reach the affected code. Exposure depends on the library version, configuration and whether untrusted Brotli input reaches decoding.