Microsoft Emergency .NET Patch for Brotli Bug You Must Install

Microsoft shipped an out of band security update on 25 October for .NET 8, 9, 10 and .NET 11 Release Candidate 3 to fix a critical buffer overflow in the Brotli decoder that Google rates 9.2. The flaw is CVE-2026-111497, called Node2Shell, Broccoli2Shell and HTTP2Shell in different advisories. An unauthenticated attacker who can get your app to decompress crafted Brotli data can read or corrupt process memory. Update to 8.0.33, 9.0.22, 10.0.14 or 11 RC3 as soon as possible.

The details here come from the Microsoft .NET blog post on 25 October 2026 by Rahul Bhandari, the Microsoft Security Response Center advisory for CVE-2026-111497, the Google Brotli releases 1.0.10, 1.1.1 and 1.2.1, and The Register, BleepingComputer and Forbes coverage on 25 and 26 October.

What did Microsoft ship?

According to Microsoft, the updates came out less than two weeks after Patch Tuesday and were published on a Sunday.

Who is actually affected?

Microsoft is clear that the vulnerability is not triggered by installing .NET. An application is affected only if it processes Brotli compressed data through one of three opt in paths.

• ASP.NET Core request decompression
• HttpClient automatic response decompression
• The System.IO.Compression Brotli APIs, such as BrotliStream or BrotliDecoder on data an attacker controls

According to Microsoft, request decompression and automatic response decompression are not enabled by default in an out of the box .NET or ASP.NET Core install. Applications must manually opt in, or must manually invoke the Brotli APIs. That is why the same advisory can be Critical for .NET and still note that many apps are not exposed.

I audited a service where the exposure was in middleware that decompressed every request with Content-Encoding br before routing. The fix was to disable automatic Brotli there and to update the runtime, as described in debug distroless container no shell.

What was the bug in Brotli?

The flaw lives in Google's Brotli C decoder in block switch handling. When the stream declares only one block type, the decoder should treat an invalid switch as a permanent format error. Vulnerable builds kept appending input bytes to an eight byte buffer. The fix cherry picks commit 0ed4268a and fails immediately with BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH. The commit was made on 27 February 2026 with no release until 21 October.

What should you update and how do you check?

The update list is short, but the check matters more than the list.

• .NET 8 → 8.0.33, SDK 8.0.133 or 8.0.427
• .NET 9 → 9.0.22, SDK 9.0.123 or 9.0.320
• .NET 10 → 10.0.14, SDK 10.0.114 or 10.0.403
• .NET 11 → Release Candidate 3 build 11.0.0-rc.3.26522.148, SDK 11.0.100-rc.3.26522.148
• Also update Visual Studio and PowerShell per the Microsoft table, and Brotli itself if you bundle it: 1.0.10, 1.1.1 or 1.2.1

Run dotnet --list-runtimes to see what you have installed. I ran the check on a host with three apps. The agent reported 8.0.32 and 9.0.21, which looked close but were still vulnerable. Updating the host runtime and rebuilding self contained apps was the pair that removed the decoder.

Why did this go from Node2Shell to .NET so fast?

The same Brotli decoder is bundled in many products. Node.js shipped fixes on 21 October, Python and Microsoft shipped on 25 October. Once the decoder is identified as the source, every product that bundles it needs the same update.

What is the verdict and what remains uncertain?

According to Microsoft, update as soon as possible, even though request decompression and HttpClient decompression are off by default. According to The Register, there is nothing to suggest criminals are using the flaw in successful attacks, but its exploitability assessment reads Exploitation More Likely.

The verdict is to update .NET to 8.0.33, 9.0.22, 10.0.14 or 11 RC3 if your app can decompress Brotli data from an external source, and to audit the three opt in paths rather than the installed package list. The decoder is the asset, not the framework version.

The limitations are threefold. First, fixing the host runtime does not fix self contained apps until they are rebuilt and redeployed. Second, fixing .NET does not fix every copy of Brotli in your stack. Check Python, Envoy and other products that bundle Brotli separately. Third, the flaw does not affect .NET Framework, so a scan that only checks Framework will miss the exposure in .NET 8 to 11.

FAQ

Does installing .NET make me vulnerable?

No. An application is not exposed merely because an affected .NET package is installed. It is exposed only if it processes Brotli data through the three opt in paths. That is the mitigation Microsoft states for many apps.

Should I update Visual Studio and PowerShell too?

Yes. Microsoft lists patched Visual Studio and PowerShell builds in the same release. The .NET runtime fix does not patch those products.

Do I need to update the Brotli npm package?

The flaw is in the bundled C decoder compiled into the runtime, not in a JavaScript package. Updating the runtime or rebuilding the self contained app is the fix.

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud

Published on debugly.dev by Rohit Bhadani | Founder of Krova Cloud