CVE-2026-111497 — a buffer-overflow bug in Google's Brotli compression — is rated 8.1 under CVSS v3.1 and, Microsoft warns, "could allow an unauthenticated attacker to read or corrupt process memory," potentially causing information disclosure, denial of service, or elevation of privilege.
Microsoft pushes emergency .NET fixes for Brotli
Microsoft released out-of-band security updates on October 25 and urged .NET users to update "as soon as possible." The company published new versions for .NET 8, 9, 10, and .NET 11 to patch the flaw, which the company described as a buffer overflow in Brotli. Senior program manager Rahul Bhandari said the vulnerability, tracked as CVE-2026-111497 and rated 8.1, could permit an unauthenticated attacker to read or corrupt process memory and lead to information disclosure, denial of service, or elevation of privilege.
Microsoft’s advisory—using informal labels such as Broccoli2Shell or Node2Shell in coverage—notes that researchers have "cobbled working exploits together," but that "there is nothing to suggest that criminals are using them in successful attacks." Still, the advisory’s exploitability assessment bluntly states: "Exploitation More Likely."
Node.js disclosure, attribution, and the February fix in Brotli
The bug was first disclosed by the Node.js team on October 21, when Node.js released fixes for ten vulnerabilities; the most serious was CVE-2026-111497. Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery. The Node.js notice did not explain why the issue was only recognized and disclosed as a security vulnerability in October despite the underlying bug having been fixed in Brotli's source code in February.
OpenAI supplied additional context in a Xeet: "This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability, and there was no more recent release of Brotli." OpenAI added: "Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software."
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogAttack paths reach beyond HTTP — FFmpeg, JPEG XL, and Apache Arrow
Exploitation can occur when a vulnerable system processes malicious Brotli-compressed data delivered via a specially crafted request, but the exploit path is not limited to traditional web traffic. JFrog researchers demonstrated an exploit affecting FFmpeg that uses a specially crafted JPEG XL image: FFmpeg reaches Brotli through libjxl, which it uses to decompress metadata stored in brob boxes within the image format.
The same researchers reported that Apache Arrow is also affected, with attackers able to cause a denial of service. Those findings expand the practical impact of the bug beyond HTTP request handlers to media processing and data libraries, widening the range of affected software that needs patching.
What this means for developers, cloud operators, and maintainers
- Developers: Rebuild and redeploy. OpenAI's Patch the Planet advisory recommended "blocking untrusted Brotli-compressed data where practical until patches can be applied" and advised maintainers to rebuild affected deployments and restart services so fixes take effect.
- Cloud operators: Watch exposure metrics. Merav Bar, a threat researcher at Wiz, said cloud exposure is extensive — "91 percent of cloud environments rely on components vulnerable to the Brotli flaw and 82 percent of cloud environments have publicly exposed Node.js instances." She warned that cloud environments are "particularly exposed due to the widespread use of Brotli-enabled components across containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads, and cloud-hosted web services."
- Maintainers and platform teams: Prioritize patch orchestration. Multiple runtimes and projects have released fixes — including .NET, Node.js, Python, Bun, Envoy, and Istio — and organizations will need to apply updates, rebuild artifacts that include Brotli, and restart services to close the various exploit paths.
Patch now; verify later
The technical record published so far paints a practical imperative: the flaw has a clear attack surface, fixes are available across a range of runtimes and libraries, researchers have demonstrated exploit techniques that extend beyond HTTP, and measurable cloud exposure is high. Although there is no public evidence of successful criminal exploitation, Microsoft’s assessment that exploitation is "More Likely," combined with demonstrable exploits developed by researchers, means the operational choice is straightforward — apply the patches, rebuild components that bundle Brotli, restart services, and where feasible block untrusted Brotli-compressed inputs until those steps are complete.
Two questions remain central: will vendors and downstream maintainers coordinate rebuilds and service restarts quickly enough across diverse supply chains, and will defensive measures such as blocking untrusted Brotli data be adopted broadly before exploitation attempts increase? The factual record published to date points squarely to execution and verification as the next critical steps.