Microsoft shipped out-of-band updates for .NET, Visual Studio and PowerShell on Sunday. They fix CVE-2026-111497, a buffer overflow in Brotli, Google’s widely used compression library, which OpenAI’s Codex Security team reported. Node.js, Python packages, proxies and other tools that bundle the library are shipping fixes too.
In a .NET blog post, Microsoft said the buffer overflow may let an unauthenticated attacker read or corrupt process memory. That could lead to information disclosure, denial of service or elevation of privilege. The update covers .NET 8, 9 and 10 and .NET 11 Release Candidate 3. Its security update guide lists the Visual Studio and PowerShell builds.
Microsoft rates the flaw critical for .NET and Visual Studio and important for PowerShell. It lists the flaw as publicly disclosed and not exploited, with exploitation “more likely”. .NET does not switch on Brotli decompression by default, and the flaw does not affect .NET Framework.
The same release completes two fixes from Microsoft’s October Patch Tuesday, which did not fully address them.
One bug, three names
The flaw, CVE-2026-111497, goes by Node2Shell, HTTP2Shell and Broccoli2Shell. It turned up first in Node.js, and researchers then traced it to Brotli’s C decoder. Many programs copy that decoder into their own code. It affects Brotli 1.0.3 to 1.2.0. Versions 1.0.10, 1.1.1 and 1.2.1 fix it. Google, which assigned the CVE, rates it 9.2 out of 10 in the CVE record.
The Node.js advisory says the decoder treated an invalid block switch as a need for more input rather than a format error.
The streaming decoder “kept appending input bytes to an eight-byte internal buffer”, Node.js wrote.
An attacker needs an application to decompress malicious data. That could be a compressed response from a server the app fetches. It could also be a compressed request someone sends straight to a server.
Fixed in February, released in October
Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security. OpenAI said in a post on X that it found the issue during red-teaming work.
“This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,” OpenAI said.
Node.js and Google shipped fixed releases on 21 October. The same week brought two critical PHP flaws, and PHP has since warned of a third.
How exposed is everyone?
Wiz, a cloud security firm, says in a blog post that 91% of cloud environments have resources vulnerable to the flaw. It says 82% have publicly exposed Node.js instances.
Imperva ran its own code on the official Node.js 24.22.0 image for Linux on ARM64. The attack did not work every time, and Imperva has not released it. A proof of concept on GitHub works only against a deliberately weakened build, Sysdig says. Researchers at Brandefense argue it can only crash programs. No one has reported an attack using the flaw.
Bun, Envoy, Istio and the Python Brotli and brotlicffi packages now have fixes. JFrog has also found the flaw in FFmpeg, ClickHouse and Apache Arrow, as Swati Khandelwal reported for The Hacker News. In some of those, the attack starts with a file rather than a web request.
A public tracker still lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as unpatched. It warns that updating a system’s Brotli library does not fix apps that bundle their own copy, such as Node.js. After updating, teams need to restart services and rebuild container images, because running processes keep the old code.