Node.js, Python and other HTTP/2 servers can be hijacked remotely
Some web servers that use the HTTP/2 connection method have a flaw that could let an outsider run commands on the server. Someone exploiting it could take control of the machine.
| Severity | CriticalVulnerability |
|---|---|
| Being exploited? | UnclearNo reports either way yet |
| Fix available? | UnclearNo fixed version published in the sources yet |
| How sure is this? | UnverifiedOnly one publisher so far, details may change |
What happened
A remote code execution flaw, reported as "http2shell", affects HTTP/2 implementations in Node, Python and other ecosystems. Specific affected versions and technical details are not stated in the source material.
Are you affected?
You are affected if you run a Node, Python or other HTTP/2-enabled server that accepts connections from the internet or untrusted networks, but the exact affected versions are unknown from the source material.
Node, Python, and other HTTP/2 implementations (specific versions unknown)
What to do
- Check the official advisories for your Node, Python or other HTTP/2 server software to confirm whether your version is affected
- Apply the vendor's patch or update as soon as one is published
- Until patched, restrict exposure of HTTP/2 services to trusted networks where possible
Timeline
- 23 Oct 2026, 23:30 UTCPublicly disclosed
- 23 Oct 2026, 23:30 UTCReported by Hacker News · Hacker News
Sources 1 report, oldest first
Community discussion sites, treat with care
- Evolving Threat: http2shell is an RCE in Node, Python, and moreHacker News · 23 Oct 2026, 23:30 UTC
Technical details
- ID
- ZR-0ac194e7
- Disclosed
- 23 Oct 2026, 23:30 UTC
- On Zero Radar
- before the radar started
- Last change
- 25 Oct 2026, 13:32 UTC
The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works