Microsoft Issues Emergency .NET Update for Brotli Compression Flaw

Microsoft is urging .NET users to update "as soon as possible" after releasing an out-of-band security update for a flaw in Google's Brotli compression technology. The buffer overflow vulnerability, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft's advisory, could let an unauthenticated attacker read or corrupt process memory. That could lead to information disclosure, denial of service, or elevation of privilege. New versions of .NET 8, 9, 10 and 11 are available, and Node.js, Python and other projects have issued similar fixes.

Attackers could exploit vulnerable systems by sending them malicious Brotli-compressed data in a specially crafted request. Some are calling the flaw Broccoli2Shell or Node2Shell. Microsoft's advisory confirms that experts have put together working exploits, but there is nothing to suggest criminals are using them in successful attacks. Even so, the company rates exploitation as "More Likely".

The Node.js team first disclosed the issue on October 21, crediting Khai Tran and Sylvie Mayer of OpenAI's Codex Security with the discovery. OpenAI said the root cause was fixed in Brotli's source code in February, but nobody knew then that it was a security vulnerability, and there was no newer Brotli release. Because Brotli is built into other software, anything that includes the library needs the update, and then the users of that software must apply it too. The flaw went slightly under the radar because its disclosure coincided with PHP2Shell, but the range of affected technologies makes fixing it a priority.