Microsoft releases emergency .NET security fixes for Google Brotli bug
Redmond joins growing list of software maintainers scrambling to patch compression flaw
Microsoft has released an emergency security update for its .NET framework to address a vulnerability in Google's Brotli compression technology. The buffer overflow flaw, tracked as CVE-2026-111497, could allow attackers to read or corrupt process memory, potentially leading to information disclosure, denial of service, or privilege escalation.
Though there is no evidence of criminal exploitation, experts believe the attack is more likely. The vulnerability, dubbed Broccoli2Shell or Node2Shell, was disclosed on October 21 by Node.js, which credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security for the discovery. OpenAI explained that the root cause issue was fixed in Brotli's source code in February, but the vulnerability went unnoticed at the time due to a coinciding disclosure of PHP2Shell. .NET 8, 9, 10, and 11 have been updated to patch the Brotli bug, as have Node.js, Python, Bun, Envoy, Istio, and FFmpeg.
Cloud environments are particularly at risk, with 91 percent of cloud environments relying on vulnerable components and 82 percent hosting exposed Node.js instances. OpenAI advised blocking untrusted Brotli-compressed data until patches are applied and recommended maintainers to rebuild affected deployments and restart services to ensure the fixes take effect.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
