Microsoft Urges Immediate .NET Updates to Patch Critical Brotli Decoder Flaw

Key points

• Microsoft issued out-of-band updates for .NET 8 (8.0.33), 9 (9.0.22), 10 (10.0.14), and 11 RC3 to patch CVE-2026-111497, a critical Brotli decoder flaw.
• The vulnerability, dubbed 'Broccoli2Shell' or 'Node2Shell,' enables unauthenticated attackers to read or corrupt memory via malicious compressed data, risking information disclosure or privilege escalation.
• The same update addresses CVE-2026-114148, a Linux-only privilege escalation issue in .NET tarballs, and finalizes fixes for CVE-2026-70197 and CVE-2026-102870 from the October 13 release.
• Microsoft advises users to update immediately, noting that request and response decompression are not enabled by default, but exposure exists if applications manually opt in to these features.
• No active exploitation has been reported, but proof-of-concept exploits are available, and OpenAI recommends blocking untrusted Brotli data until patches are applied.

Background

This incident follows a pattern of emergency out-of-band updates Microsoft has issued in 2026, including September patches for critical bugs in its record-breaking September Patch Tuesday. The current .NET update is part of a broader industry response to the Brotli vulnerability, with Node.js, Python, and other projects releasing similar fixes. The underlying bug was fixed in Brotli’s source code in February 2026 but was not recognized as a security flaw until October, highlighting challenges in tracking embedded library vulnerabilities.

How outlets are covering it

The Register and BleepingComputer emphasize the critical severity of CVE-2026-111497, noting CVSS scores of 8.1 and 9.2 respectively, and highlight the lack of active exploitation despite available proof-of-concept exploits. Infosecurity Magazine and CyberSecurityNews provide detailed technical guidance, stressing that the vulnerability affects applications using ASP.NET Core request decompression or HttpClient response decompression, which are not enabled by default. CyberSecurityNews also notes that the update completes fixes for two vulnerabilities missed in the October 13 Patch Tuesday, while The Register highlights the broader impact on cloud environments, with 91% of cloud environments relying on vulnerable Brotli components. All sources agree on the urgency of patching but differ in emphasis: The Register focuses on the industry-wide scramble, while Infosecurity Magazine and CyberSecurityNews detail the specific remediation steps for different .NET deployment types.

Why it matters

The Brotli vulnerability affects a wide range of technologies, including .NET, Node.js, Python, and FFmpeg, posing a significant risk to cloud and containerized applications. Microsoft’s emergency update is critical for organizations using .NET to prevent potential remote code execution or denial of service attacks. The incident underscores the importance of promptly patching embedded libraries and the challenges in tracking vulnerabilities in widely used compression technologies.

What to watch

Microsoft expects users to apply the out-of-band updates immediately, with specific guidance for framework-dependent, self-contained, and containerized applications. OpenAI recommends blocking untrusted Brotli-compressed data until patches are applied. The broader industry is expected to continue releasing patches for affected software, and security teams should monitor for any signs of active exploitation. Microsoft may issue further updates if new vulnerabilities are discovered in related components.