Sweet Security Research Identifies Go Implementation of Node2Shell Vulnerability, Expanding Attack Surface to Major HTTP Frameworks

Candy Secu ity e gi ee discove s repair pushed to Go B otli lib a y, co fi mi g vul e means existed ac oss la guage impleme tatio s; T aefik, Fibe , a d I is amo g affected f amewo ks

TEL AVIV, Is ael, Oct. 25, 2026 (GLOBE NEWSWIRE) — Candy Secu ity right this moment disclosed ew esea ch fi di gs expa di g the ok ow scope of the Node2Shell vul e means beyo d its o igi al C impleme tatio . Tome Be Ge a, a e gi ee o Candy Secu ity’s se so crew, ide tified {that a} pa allel repair was pushed to the Go impleme tatio of the B otli comp essio lib a y o Octobe 23, co fi mi g the identical vul e means class existed i Go.

The fi di g sig ifica tly expa ds the pote tial assault su face. The Go B otli lib a y is a di ect o i di ect depe de cy of seve al majo HTTP f amewo ks, i cludi g T aefik, Fibe , a d I is, with combi ed GitHub adoptio exceedi g 130,000 sta s a d T aefik alo e accumulati g ove o e billio cumulative Docke picture pulls.

“The simulta eous repair ac oss each C a d Go impleme tatio s is a st o g sig al that the vul e means class is ot la guage-specific,” stated Tome Be Ge a, Se so Staff E gi ee , Candy Secu ity. “Whe e the e is a repair i Go, the e was a p oblem i Go. Secu ity groups which have centered emediatio effo ts o thei Node a d PHP e vi o me ts eed to exte d that assessme t to thei Go-based HTTP i f ast uctu e.”

Key Fi di gs

The Go B otli lib a y repair, pushed app oximately two days in the past alo gside the o igi al C emediatio , i dicates the u de lyi g memo y-ma ageme t flaw p ese t i the C impleme tatio was eplicated i Go. Candy Secu ity’s a alysis ide tified fou majo Go HTTP p ojects with co fi med depe de cy o the affected lib a y:

• T aefik, with ove 65,000 GitHub sta s a d mo e tha o e billio cumulative Docke pulls, makes use of the lib a y as a di ect depe de cy i its Comp ess middlewa e fo e codi g outgoi g B otli espo ses.
• Fibe , with ove 40,000 sta s, ca ies a i di ect depe de cy th ough fasthttp i v2.52.9, with equest-body decodi g uncovered th ough Ctx.Physique() a d JSON BodyPa se , c eati g a path whe e clie t-co t olled comp essed our bodies might t igge the vul e means.
• I is, with ove 25,000 sta s, ca ies the lib a y as a di ect depe de cy with suppo t fo each espo se e codi g a d equest decodi g.
• fasthttp, with ove 23,000 sta s, ca ied the lib a y as a di ect depe de cy th ough v1.73.0 befo e mig ati g to a alte ative i v1.74.0.

Candy Secu ity otes that depe de cy p ese ce alo e does ot set up vul e means o eachability. Ve sio s, e code ve sus decode utilization, a d applicatio -level co figu atio all have an effect on precise exposu e. O ga izatio s ought to ve ify which ve sio of the lib a y is i use a d whethe B otli decodi g of clie t-co t olled i put is e abled i thei particular co figu atio .

Implicatio s fo Secu ity Groups

The expa sio of Node2Shell to Go-based HTTP i f ast uctu e mea s o ga izatio s u i g T aefik as a eve se p oxy o load bala ce , applicatio s constructed o Fibe o I is, a d a y Go HTTP se vice usi g B otli equest decomp essio ought to t eat this as a lively a ea of i vestigatio athe tha a futu e co ce .

T aditio al vul e means sca e s face a st uctu al limitatio i assessi g this class of vul e means. As a result of Node a d Go bi a ies do ot observe p edictable i stallatio paths, sca e s that ely o ok ow paths a d package deal egist ies could ot detect the p ese ce of the vul e ready lib a y. Ru time visibility, which ide tifies what is definitely executi g athe tha what is predicted to be p ese t, is equi ed to accu ately assess exposu e.

Candy Secu ity ecomme ds o ga izatio s instantly i ve to y Go-based HTTP se vices fo B otli lib a y depe de cies, ve ify lib a y ve sio s agai st the patched eleases, assess whethe clie t-co t olled B otli decodi g is e abled, a d mo ito u time behavio fo sig s of exploitatio i cludi g u anticipated p ocess executio , u regular outbou d co ectio s, a d ab o mal memo y behavio i HTTP wo ke p ocesses.

Candy Secu ity is co ti ui g to mo ito each Node2Shell a d the b oade HTTP2Shell vul e means class a d will p ovide up to date detectio guida ce a d i dicato s of comp omise because the situatio develops.

To lea mo e, ead Candy Secu ity’s esea ch weblog o the Node2Shell vul e means a d the way it exte ds beyo d the o igi al C impleme tatio .

Media Co tacts:

Noa Glumche VP Ma keti g, Candy Secu ity oag@candy.secu ity

Chloe Ama teMo t e Tech PRcama te@mo t e .com

A photograph accompa yi g this a ou ceme t is offered at https://www.globe ewswi e.com/NewsRoom/Attachme tNg/4e0ebb6c-0f63-4b7a-8a01-500c8690deb9