Microsoft Rushes Out Emergency Patches for Critical Brotli Compression Flaw Affecting .NET, Visual Studio

Because numerous applications embed the vulnerable Brotli decoder directly into their own binaries, remediation requires individual patches for each affected tool. According to cloud security firm Wiz, 91% of cloud environments currently host vulnerable resources.

On Sunday, Microsoft released emergency updates addressing CVE-2026-111497, a buffer overflow in Brotli, Google's widely deployed compression library. The vulnerability was discovered by OpenAI's Codex Security team. Beyond Microsoft's response, Node.js, Python packages, proxies and numerous other software components that incorporate the library are also rolling out fixes.

In its .NET blog post, Microsoft explained that the buffer overflow vulnerability could permit an unauthenticated attacker to access or modify process memory. This could result in information leakage, service disruption or privilege escalation. The patches cover .NET 8, 9 and 10 as well as .NET 11 Release Candidate 3, with specific builds for Visual Studio and PowerShell detailed in Microsoft's security update guide.

Microsoft classified the vulnerability as critical for .NET and Visual Studio, and important for PowerShell. The flaw has been publicly disclosed but remains unexploited, though exploitation is considered "more likely". Since .NET does not enable Brotli decompression by default, and the vulnerability does not impact .NET Framework, exposure is somewhat limited in those contexts.

The same Sunday release also completed remediation for two vulnerabilities from Microsoft's October Patch Tuesday that had not been fully resolved.

One vulnerability, multiple identities

CVE-2026-111497 circulates under three different names: Node2Shell, HTTP2Shell and Broccoli2Shell. The issue was initially discovered in Node.js before researchers traced its origin to Brotli's C decoder. Since many applications copy this decoder into their own codebases, the vulnerability affects Brotli versions 1.0.3 through 1.2.0. Fixed versions include 1.0.10, 1.1.1 and 1.2.1. Google, which assigned the CVE identifier, assigned it a severity score of 9.2 out of 10.

According to the Node.js advisory, the decoder incorrectly handled an invalid block switch by treating it as a signal for additional input rather than recognizing it as a format violation.

The streaming decoder "kept appending input bytes to an eight-byte internal buffer"

Node.js

For an attack to succeed, an application must decompress attacker-controlled data. This could occur when an application processes a compressed response retrieved from a server, or when a server receives a compressed request from an attacker.

Fixed months before disclosure

Node.js credited Khai Tran and Sylvie Mayer from OpenAI's Codex Security with discovering the issue. OpenAI disclosed in a post on X that the vulnerability surfaced during red-teaming activities.

This root cause issue was actually fixed in the Brotli source code in February, but it wasn't known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli

OpenAI

Node.js and Google released patched versions on 21 October. That same week saw the emergence of two critical PHP vulnerabilities, with PHP subsequently alerting users to a third flaw.

Assessing the scope of exposure

Wiz, a cloud security provider, reported in its own analysis that 91% of cloud environments contain vulnerable resources. The firm also noted that 82% have Node.js instances accessible from the public internet.

Imperva tested its own exploit code against the official Node.js 24.22.0 image compiled for Linux on ARM64. The attack succeeded inconsistently, and Imperva has not made the exploit public. A proof-of-concept available on GitHub functions only against a deliberately compromised build, according to Sysdig. Researchers at Brandefense contend the vulnerability can only trigger denial of service. To date, no active exploitation in the wild has been documented.

Bun, Envoy, Istio, the Python Brotli and brotlicffi packages have all released fixes. JFrog identified the same vulnerability in FFmpeg, ClickHouse and Apache Arrow, as reported by Swati Khandelwal for The Hacker News. In certain instances, the attack vector involves a file rather than a network request.

A public vulnerability tracker continues to list DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as still unpatched. The tracker cautions that updating the system-level Brotli library does not resolve the vulnerability in applications that maintain their own bundled copy, such as Node.js. Following updates, organizations must restart running services and rebuild container images, since active processes retain the old vulnerable code.

Source: The Next Web