Microsoft Ships Emergency .NET Fixes for Critical Brotli Flaw

Microsoft has pushed out-of-band (emergency) security updates for .NET, Visual Studio and PowerShell to fix a serious memory bug in Brotli, the widely used compression library created by Google. The flaw, tracked as CVE-2026-111497, is the same bug that forced urgent Node.js releases last week under nicknames such as Node2Shell, HTTP2Shell and Broccoli2Shell. This update matters to developers, IT administrators and any business that runs web applications or internal tools built on .NET.

What happened

Microsoft released the out-of-band updates on Sunday, 25 October, outside its usual monthly Patch Tuesday cycle. According to reporting by The Register and The Next Web, the fixes cover .NET 8, .NET 9 and .NET 10, plus the .NET 11 Release Candidate 3. Affected Visual Studio and PowerShell builds are listed in Microsoft’s Security Update Guide.

Microsoft rates the issue critical for .NET and Visual Studio and important for PowerShell. Its advisory gives a CVSS v3.1 score of 8.1, while Google’s CVE record scores it 9.2 out of 10. The same release also completes two fixes from October’s Patch Tuesday that had not been fully addressed, which is another reason not to delay.

Is it being exploited?

The flaw has been publicly disclosed, but there are no confirmed reports of criminals using it in real attacks. Microsoft’s own assessment says exploitation is “more likely”. Security researchers have built working proofs of concept in test conditions, though results vary: Imperva reported that its attack on Node.js did not always succeed, and Sysdig said a public proof of concept reportedly works only against a deliberately weakened build. Some researchers argue the bug can only crash programs. Even so, the safe assumption is that attackers are studying it.

How the Brotli flaw works

Brotli is used to compress and decompress web traffic and files. The bug sits in Brotli’s decoder. When it receives a specially crafted compressed stream, it treats an invalid instruction as a request for more data instead of rejecting it as an error. As a result, it keeps writing incoming data into a small internal buffer, overflowing it.

According to Microsoft, an unauthenticated attacker who triggers this could read or corrupt process memory, which may lead to:

• information disclosure,
• denial of service (crashing the application), or
• elevation of privilege.

The important condition

An application is only at risk if it decompresses Brotli data supplied by an attacker. That could be a compressed request sent to a web server, or a compressed response an application fetches from somewhere else. Notably, .NET does not enable Brotli decompression by default, and the older .NET Framework is not affected. That lowers the risk for many organisations, but developers often turn on decompression for APIs and proxies, so check rather than assume.

Who is affected beyond Microsoft

Because Brotli is embedded in so much software, this is a supply-chain problem rather than a single-vendor bug. The affected Brotli versions run from 1.0.3 through 1.2.0, with fixes in versions 1.0.10, 1.1.1 and 1.2.1.

• Node.js and Google shipped fixed releases on 21 October. Node.js described this as the most serious of ten fixes in that release.
• Bun, Envoy, Istio and the Python Brotli and brotlicffi packages have released patches.
• JFrog found the flaw reachable in FFmpeg (through a crafted JPEG XL image), ClickHouse and Apache Arrow, meaning some attacks could start with a file rather than a web request.
• A public tracker listed DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as still unpatched at the time of reporting.

Cloud security firm Wiz estimated that 91% of cloud environments contain vulnerable components and 82% have publicly exposed Node.js instances. Those figures are vendor estimates, but they show how widespread Brotli is.

Why it took so long

The flaw was found by OpenAI’s Codex Security team, and Node.js credited researchers Khai Tran and Sylvie Mayer. OpenAI said the root cause was actually fixed in Brotli’s source code back in February, but its security impact was not recognised at the time and no new Brotli release followed. That left many products shipping old, vulnerable copies for months.

Why this matters for African businesses

Many Nigerian and African fintechs, banks, logistics firms and software agencies build on .NET and Node.js, and run them in containers on public cloud platforms. A single vulnerable library can sit inside dozens of services and container images. Teams that patched Node.js last week should not assume they are done: .NET services, PowerShell automation, media-processing pipelines and data tools may each carry their own copy of Brotli.

What you should do

1. Install Microsoft’s updates for .NET 8, 9 and 10 (and .NET 11 RC3 if you test preview builds), Visual Studio and PowerShell. Microsoft advises updating as soon as possible.
2. Find bundled copies of Brotli. Updating the operating system’s Brotli library does not fix applications that ship their own copy, such as Node.js. Check your software inventory and dependency lists.
3. Rebuild container images so they include the fixed runtimes and libraries, then redeploy.
4. Restart services after patching. Running processes keep using the old code until they restart.
5. Prioritise internet-facing services that decompress untrusted data, such as APIs, reverse proxies and file upload handlers.
6. Where you cannot patch yet, consider blocking untrusted Brotli-compressed input as a temporary measure.
7. Watch vendor advisories for tools still waiting on fixes, including the data and archiving tools listed above.

If your business relies on an outside developer or managed service provider, ask them directly whether your applications use .NET or Node.js with Brotli decompression, and when they will apply these updates.

Sources

• The Register: Microsoft releases emergency .NET security fixes for Google Brotli bug
• The Next Web: Microsoft patches critical Brotli flaw in .NET and Visual Studio

Featured image: Photo: “Programmer Code” by unknown, CC CC0 1.0, via Openverse — source