Microsoft has released an emergency out-of-band patch for a critical vulnerability in its .NET platform. The flaw, called Node2Shell, sits deep inside Brotli, the compression library that powers much of the modern web. Microsoft shipped the fix on Sunday after researchers warned that exploitation was becoming more likely.
The vulnerability has the CVE identifier CVE-2026-111497 and a severity score of 9.2 out of 10. OpenAI’s Codex Security team first discovered the flaw during red-teaming work. Specifically, researchers Khai Tran and Sylvie Mayer reported the issue to Node.js. The Node.js team then traced it back to Brotli’s C decoder. In fact, the decoder treated an invalid block switch as a request for more input. It should have flagged a format error instead.
| CVE | Description | Affected platforms |
|---|---|---|
| CVE-2026-111497 | A buffer overflow vulnerability exists in .NET’s use of the Brotli decompression algorithm. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. | All Platforms |
| CVE-2026-114148 | Unsafe ownership metadata in affected .NET tarballs could allow a local attacker to modify files and gain elevated privileges. | Linux |
The flaw affects Brotli versions 1.0.3 through 1.2.0. Fixed releases arrived in versions 1.0.10, 1.1.1, and 1.2.1 last week. In addition, an unauthenticated attacker can exploit the bug to read or corrupt process memory. As a result, this opens the door to information disclosure, denial of service, or privilege escalation.
Microsoft’s emergency patch covers .NET 8, 9, 10, and .NET 11 Release Candidate 3. The update also fixes affected Visual Studio and PowerShell builds. However, the older .NET Framework is not affected because .NET does not enable Brotli decompression by default.
The scope of the problem extends well beyond Microsoft. Bun, Envoy, Istio, and the Python Brotli packages all shipped their own fixes. Furthermore, JFrog researchers found the flaw in FFmpeg, ClickHouse, and Apache Arrow. Node.js and Google released fixed builds on October 21.
Cloud security firm Wiz says 91% of cloud environments contain vulnerable resources. On top of that, 82% have publicly exposed Node.js instances. However, no attacker has actually used the flaw in a real attack yet.
Pakistani developers who use .NET, Node.js, or any affected library should patch immediately. In addition, teams running containerized services must rebuild their images because running processes still hold the old code. Furthermore, hosted applications on cloud platforms like Azure need the update to stay safe.
