CISA has added a critical Brotli-related vulnerability commonly referred to as Node2Shell, Broccoli2Shell and HTTP2Shell to its list of actively exploited security issues, indicating that attackers have started using it in real-world attacks. While the alert comes from a US agency, the practical implications extend well beyond the US because Node.js components and Brotli compression are widely used in web applications, APIs and digital platforms.

What happened

According to the report, CISA confirmed that threat actors are now exploiting the vulnerability. The flaw has been described as critical and is associated with Brotli handling in environments linked to Node.js and HTTP services. At this stage, the key confirmed development is not just that a vulnerability exists, but that exploitation has moved from a theoretical or disclosed risk to an active one.

That distinction matters for businesses because actively exploited flaws usually increase the urgency of patching, exposure checks and incident monitoring. In practice, internet-facing services are typically at highest risk once exploitation becomes public and repeatable.

Why it matters for European businesses

Many European companies rely on Node.js in customer-facing websites, e-commerce systems, headless commerce setups, APIs, SaaS products and internal business tools. Even where a company does not directly build on Node.js, agencies, software vendors and hosting providers may use it within the application stack.

If a critical flaw affects commonly deployed web infrastructure, the business risk can go beyond technical downtime. Potential consequences may include:

• service disruption on public websites or applications
• unauthorised access or remote code execution, depending on the affected implementation
• risk to customer data or internal systems if a vulnerable service is connected to other infrastructure
• emergency maintenance windows, delayed campaigns or e-commerce interruption
• added compliance pressure if an incident leads to personal data exposure or operational disruption

For European organisations, this also intersects with broader governance obligations. A successful attack could trigger internal security reporting, customer communication requirements or data protection assessment under GDPR if personal data is affected. For some sectors, NIS2-related risk management expectations may also increase the importance of timely remediation, although businesses should assess their exact obligations based on their sector, size and national implementation.

Who may be affected

The organisations most likely to be affected include businesses that run or depend on:

• Node.js-based websites or web applications
• HTTP services using Brotli compression
• custom e-commerce platforms or storefront middleware
• JavaScript-heavy backend services and APIs
• managed hosting, PaaS or SaaS products built on vulnerable components
• digital agencies and IT teams maintaining multiple client websites or applications

Smaller businesses may be exposed indirectly through third-party providers. That means the issue is relevant not only for in-house development teams, but also for founders, operations managers and marketing teams whose websites or digital sales channels depend on external platforms.

What companies should consider

European businesses do not need to wait for a full incident to act. The immediate priority is to establish whether any internet-facing systems use affected Node.js or Brotli-related components and whether updates or vendor mitigations are available.

• Identify exposure: inventory Node.js services, web applications, APIs and reverse-proxy setups that may use Brotli compression or affected libraries.
• Patch quickly: apply available security updates from maintainers, platform vendors or hosting providers as soon as they are validated for production use.
• Review third parties: ask software suppliers, agencies and cloud providers whether their services are affected and what remediation steps they have taken.
• Increase monitoring: check logs, application telemetry and endpoint alerts for unusual requests, crashes, unauthorised command execution or suspicious post-exploitation activity.
• Restrict exposure where possible: reduce public access to non-essential services, segment vulnerable workloads and use web application firewall or reverse-proxy controls where appropriate.
• Prepare response steps: make sure rollback, backup and incident escalation processes are ready in case patching reveals compromise or service instability.

For companies running revenue-generating websites or customer portals, this is primarily an operational resilience issue: a vulnerable component in the web stack can quickly become a business continuity problem. The CISA alert is therefore relevant for European IT and digital teams even if their organisations are outside the US.