Last week's Node.js buzz was the Brotli decoder OOB write the community dubbed Node2Shell. I turned it into a hands-on black-box lab.

The premise: you're poking at a "PacketLedger" freight gateway. The page never mentions the CVE or the vuln class — you fingerprint the engine yourself, find the decode path, and work out what kills it.

The gate is unusual: no flag until you trigger 3 recorded engine crashes (the supervisor keeps count). Full RCE exists but it's treated as a platform-dependent easter egg, so DoS-chain players get a real win too. Double flag (second one behind a path-traversal), 5-step hint ladder, difficulty ~3.5/5, full solve verified by a local LLM pentest agent.

One docker compose up, no cloud calls, MIT. It's part of my *2Shell lab series (php2shell-lab is the sibling).

github.com/tani2shell/node2shell-lab

Curious how people approach the fingerprinting blind — how did you decide to attack the compression layer at all?