{"id":749818,"date":"2026-10-27T01:31:23","date_gmt":"2026-10-26T22:31:23","guid":{"rendered":""},"modified":"2026-10-27T01:31:23","modified_gmt":"2026-10-26T22:31:23","slug":"microsoft-ships-emergency-net-fixes-for-a-critical-brotli-flaw","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/microsoft-ships-emergency-net-fixes-for-a-critical-brotli-flaw\/","title":{"rendered":"Microsoft ships emergency .NET fixes for a critical Brotli flaw"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af19b0031aaa\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af19b0031aaa\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/microsoft-ships-emergency-net-fixes-for-a-critical-brotli-flaw\/#One_bug_three_names\" >One bug, three names<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/microsoft-ships-emergency-net-fixes-for-a-critical-brotli-flaw\/#Fixed_in_February_released_in_October\" >Fixed in February, released in October<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/microsoft-ships-emergency-net-fixes-for-a-critical-brotli-flaw\/#How_exposed_is_everyone\" >How exposed is everyone?<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/10\/source-code-terminal-dark-monitor-close-up.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p>Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google\u2019s widely used compression library, which OpenAI\u2019s Codex Security team reported. Node.js, Python packages, proxies and other tools that bundle the library are shipping fixes too.<\/p>\n<p>In a <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/devblogs.microsoft.com\/dotnet\/dotnet-october-2026-oob-security-updates\/\" target=\"_blank\" rel=\"nofollow noopener\">.NET blog post<\/a>, Microsoft said the buffer overflow may let an unauthenticated attacker read or corrupt process memory. That could lead to information disclosure, denial of service or elevation of privilege. The update covers .NET 8, 9 and 10 and .NET 11 Release Candidate 3. Its <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2026-111497\" target=\"_blank\" rel=\"nofollow noopener\">security update guide<\/a> lists the Visual Studio and PowerShell builds.<\/p>\n<p>Microsoft rates the flaw critical for .NET and Visual Studio and important for PowerShell. It lists the flaw as publicly disclosed and not exploited, with exploitation \u201cmore likely\u201d. .NET does not switch on Brotli decompression by default, and the flaw does not affect .NET Framework.<\/p>\n<p>The same release completes two fixes from Microsoft\u2019s October Patch Tuesday, which did not fully address them.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"One_bug_three_names\"><\/span>One bug, three names<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The flaw, CVE-2026-111497, goes by Node2Shell, HTTP2Shell and Broccoli2Shell. It turned up first in Node.js, and researchers then traced it to Brotli\u2019s C decoder. Many programs copy that decoder into their own code. It affects Brotli 1.0.3 to 1.2.0. Versions 1.0.10, 1.1.1 and 1.2.1 fix it. Google, which assigned the CVE, rates it 9.2 out of 10 in the <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-111497\" target=\"_blank\" rel=\"nofollow noopener\">CVE record<\/a>.<\/p>\n<p>The <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" target=\"_blank\" rel=\"nofollow noopener\">Node.js advisory<\/a> says the decoder treated an invalid block switch as a need for more input rather than a format error.<\/p>\n<blockquote>\n<p>The streaming decoder \u201ckept <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ending input bytes to an eight-byte internal buffer\u201d, Node.js wrote.<\/p>\n<\/blockquote>\n<p>An attacker needs an application to decompress malicious data. That could be a compressed response from a server the app fetches. It could also be a compressed request someone sends straight to a server.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Fixed_in_February_released_in_October\"><\/span>Fixed in February, released in October<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Node.js credited Khai Tran and Sylvie Mayer of OpenAI\u2019s Codex Security. OpenAI said in a <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/OpenAI\/status\/2113766354386084338\" target=\"_blank\" rel=\"nofollow noopener\">post on X<\/a> that it found the issue during red-teaming work.<\/p>\n<blockquote>\n<p>\u201cThis root cause issue was actually fixed in the Brotli source code in February, but it wasn\u2019t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,\u201d OpenAI said.<\/p>\n<\/blockquote>\n<p>Node.js and Google shipped fixed releases on 21 October. The same week brought two critical PHP flaws, and PHP has since warned of a third.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_exposed_is_everyone\"><\/span>How exposed is everyone?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Wiz, a cloud security firm, says in a <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.wiz.io\/blog\/cve-2026-111497-brotli-rce-node-js\" target=\"_blank\" rel=\"nofollow noopener\">blog post<\/a> that 91% of cloud environments have resources vulnerable to the flaw. It says 82% have publicly exposed Node.js instances.<\/p>\n<p><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.imperva.com\/blog\/node2shell-from-brotli-data-to-remote-code-execution\/\" target=\"_blank\" rel=\"nofollow noopener\">Imperva<\/a> ran its own code on the official Node.js 24.22.0 image for Linux on ARM64. The attack did not work every time, and Imperva has not released it. A proof of concept on GitHub works only against a deliberately weakened build, <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.sysdig.com\/blog\/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce\" target=\"_blank\" rel=\"nofollow noopener\">Sysdig<\/a> says. Researchers at <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/brandefense.io\/blog\/node2shell-nodejs-brotli-rce-cve-2026-111497\/\" target=\"_blank\" rel=\"nofollow noopener\">Brandefense<\/a> argue it can only crash programs. No one has reported an attack using the flaw.<\/p>\n<p>Bun, Envoy, Istio and the Python Brotli and brotlicffi packages now have fixes. JFrog has also found the flaw in FFmpeg, ClickHouse and Apache Arrow, as Swati Khandelwal reported for <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/thehackernews.com\/2026\/10\/brotli-decoder-flaw-behind-nodejs-rce.html\" target=\"_blank\" rel=\"nofollow noopener\">The Hacker News<\/a>. In some of those, the attack starts with a file rather than a web request.<\/p>\n<p>A <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/broccoli2shell.com\/\" target=\"_blank\" rel=\"nofollow noopener\">public tracker<\/a> still lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as unpatched. It warns that updating a system\u2019s Brotli library does not fix apps that bundle their own copy, such as Node.js. After updating, teams need to restart services and rebuild container images, because running processes keep the old code.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/microsoft-net-emergency-patch-brotli-flaw-node2shell\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google\u2019s widely used compression library, which OpenAI\u2019s Codex Security team reported. Node.js, Python packages, proxies and other tools that bundle the library are shipping fixes too. In a .NET blog post, Microsoft said the buffer&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-749818","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/749818","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=749818"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/749818\/revisions"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=749818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=749818"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=749818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}