Security

Brotli vulnerability: Microsoft ships emergency fixes for .NET, Visual Studio and PowerShell

Microsoft released out-of-band security updates for .NET, Visual Studio and PowerShell on Sunday, October 25, to fix CVE-2026-111497, a Brotli vulnerability that lets crafted compressed data write past the end of a memory buffer. Node.js and Google patched the same flaw on October 21, and developers and server admins who decompress untrusted data with Brotli should update now.

By Techieslite ·

Techieslite graphic with the Microsoft name and the headline "Brotli flaw: Microsoft ships emergency .NET fixes"

What the flaw does

Brotli is a lossless compression format, and Google maintains its reference library. The bug is in that library's decoder. Node.js bundles its own copy of the decoder, so updating a system Brotli library doesn't fix it. Security researchers have nicknamed the flaw Node2Shell and HTTP2Shell.

Node.js says an invalid block switch in the compressed data was treated as a temporary need for more input rather than an error, so the decoder kept adding bytes to an 8-byte internal buffer. An attacker who can get an application to decompress malicious Brotli data "can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution," according to the Node.js advisory.

Node.js credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with reporting the bug. Microsoft lists it as publicly disclosed but not exploited, and rates exploitation as "more likely."

Microsoft's out-of-band updates

Microsoft shipped the fixes outside its usual monthly schedule. It rates the flaw 8.1 out of 10 on the CVSS 3.1 scale, critical for .NET and Visual Studio and important for PowerShell. The patched versions are:

Microsoft says apps are affected if they use Brotli decompression through ASP.NET Core request decompression, automatic response decompression in HttpClient or the Brotli APIs in System.IO.Compression. Automatic request and response decompression are off by default. The older .NET Framework is not affected.

Node.js, Brotli and Python fixes

Node.js fixed the flaw on October 21 in versions 22.23.4, 24.22.1 and 26.12.1, as part of a security release that also fixes several other bugs. It rates the Brotli issue high severity. Node.js says end-of-life versions are affected too and should move to a supported release.

Google published Brotli 1.0.10, 1.1.1 and 1.2.1 the same day, each listing the fix for CVE-2026-111497. On the Python side, the Brotli 1.2.1 and brotlicffi 1.2.1.0 packages arrived on PyPI on October 22. PHP also rebuilt its Windows packages with Brotli 1.2.1 on October 26, which we noted in our PHP2Shell coverage.

What it means for you

The affected software is mostly runtimes, developer tools and server components, so the work falls on the people who build and run apps, websites and internal tools. Small businesses that host their own web apps should check with whoever maintains them.

Developers and admins should install the patched .NET runtime or SDK, Node.js release and Python packages, then update Visual Studio and PowerShell 7 if they use them. Running processes keep the old code in memory, so restart services after updating. Container images need to be rebuilt on patched base images, and an app that bundles its own copy of Brotli needs its own update, not just a new system library.

Sources