Microsoft Rushes Out-of-Band .NET Fixes for Brotli Decoder Flaw Dubbed Broccoli2Shell

Microsoft has issued emergency security updates for .NET to fix a memory-corruption bug in Brotli, Google's widely used data compression library. The flaw is tracked as CVE-2026-111497 and has been nicknamed Broccoli2Shell, Node2Shell and HTTP2Shell. The Node.js project first disclosed it publicly on October 21, and Microsoft published its own advisory and out-of-band (OOB) fixes on Sunday, October 25. Out-of-band means the patches arrived outside the company's regular monthly update schedule. Microsoft joins a growing group of software maintainers patching the same underlying problem, and it is telling .NET users to install the updates without delay.

What happened

The story starts months before most people heard of the bug. According to OpenAI, the root cause was fixed in Brotli's source code in February 2026. At that point nobody understood that the code change closed a security hole. No new official Brotli release followed, so the fix never reached the many products that bundle the library.

On October 21, the Node.js team shipped fixes for ten vulnerabilities. The most serious was CVE-2026-111497. Node.js credited the discovery to Khai Tran and Sylvie Mayer of OpenAI's Codex Security team. As reported by The Register, Node.js did not explain why the bug was only recognised and disclosed as a security issue in October. OpenAI later filled in some of that gap in a social media post. It said the February fix had not been identified as security-relevant at the time. It also stressed that every product embedding Brotli must take the update, and then the users of those products must install it in turn.

Other projects followed. Python, Bun, Envoy and Istio have all released patches, according to The Register. On October 25, Microsoft senior program manager Rahul Bhandari announced new .NET builds, and Microsoft published its advisory the same day.

The Register noted that the flaw drew less attention than it deserved at first. Its disclosure landed at almost the same moment as PHP2Shell, a separate set of vulnerabilities that BleepingComputer reports are now being exploited in the wild.

Who is affected

Microsoft's updates cover .NET 8, .NET 9 and .NET 10, plus the preview of .NET 11. BleepingComputer specifies the preview as .NET 11 Release Candidate 3, while The Register simply refers to .NET 11.

Not every .NET application is at risk. Microsoft says an app is exposed only if it handles Brotli-compressed data in one of three ways:

• decompressing incoming requests through ASP.NET Core's request decompression feature;
• using automatic response decompression in HttpClient;
• calling the Brotli APIs in System.IO.Compression directly.

Microsoft notes that a standard, out-of-the-box .NET or ASP.NET Core installation does not turn on Brotli decompression. Developers must deliberately enable it or call the APIs themselves.

Beyond .NET, the flaw reaches any HTTP client, server, application or tool that relies on a vulnerable copy of Brotli. Named products include Node.js, Python, Bun, Envoy and Istio. Researchers at JFrog showed that the problem also extends past web traffic. They built an exploit against FFmpeg, the popular media-processing toolkit, using a booby-trapped JPEG XL image. FFmpeg reaches Brotli through libjxl, which uses it to unpack metadata stored in so-called "brob boxes" inside the image file. JFrog also said Apache Arrow is affected, where an attacker could cause a denial of service.

Cloud environments look especially exposed. Merav Bar, a threat researcher at Wiz, said 91 percent of cloud environments rely on components affected by the Brotli flaw, and 82 percent have Node.js instances exposed to the internet. She pointed to containerised apps, Kubernetes clusters, API gateways, reverse proxies, serverless workloads and cloud-hosted web services as places where Brotli-enabled components are common.

How it works

Brotli is a "lossless" compression method, meaning data can be squeezed down and later restored exactly. Web servers and browsers use it heavily to make pages and files smaller during transfer. The part of the library that restores compressed data is called the decoder.

The bug sits in that decoder. BleepingComputer describes it as an out-of-bounds write, and The Register calls it a buffer overflow. Both terms describe the same basic mistake. A program sets aside a fixed block of memory, known as a buffer, but then writes data beyond its edge. That spillover can overwrite other information the program depends on.

In practice, an attacker sends a target system a specially crafted chunk of Brotli-compressed data, for example inside a web request. When the vulnerable decoder tries to unpack it, memory can be corrupted or read in ways the developers never intended. Microsoft says the results could include leaking information, crashing the service, or raising an attacker's privileges. BleepingComputer adds that, in some cases, the bug could allow remote code execution, which means running the attacker's own commands on the device. The attacker does not need to log in first.

How serious is it?

The reporting differs on how to label the severity. BleepingComputer describes CVE-2026-111497 as critical. The Register reports that Microsoft's advisory gives it a CVSS v3.1 score of 8.1. CVSS is the industry's standard 0–10 scale for rating vulnerabilities, and on that scale 8.1 falls in the "high" band rather than "critical". No independently verified CVE record was available to settle the difference, so readers should treat 8.1 as Microsoft's own rating for .NET. The severity may differ for other products that embed Brotli.

Both outlets agree on the exploitation picture. Proof-of-concept exploits, which are working demonstrations built by researchers, have already appeared on GitHub. However, there are no reports of criminals using the flaw in real attacks so far. Even so, Microsoft's exploitability assessment reads "Exploitation More Likely", which signals that the company expects attackers to try.

The wide reach is what makes this bug stand out. Because Brotli is compiled into so much other software, a single flaw now requires patches from many different vendors and projects.

What to do now

For administrators and developers:

• Install Microsoft's OOB updates for .NET 8, 9, 10 and the .NET 11 preview straight away.
• Check whether your apps use ASP.NET Core request decompression, HttpClient automatic decompression, or the System.IO.Compression Brotli APIs. These apps are the top priority.
• Patch the other affected platforms you run, including Node.js, Python, Bun, Envoy and Istio. Also review FFmpeg and Apache Arrow deployments.
• Remember that updating the system's Brotli library will not protect applications that ship their own bundled copy. Each of those needs its own fix.
• Rebuild affected deployments, such as container images, and restart services so the patched code actually loads. OpenAI recommends this through its Patch the Planet initiative.
• If you cannot patch yet, use a proxy or firewall to block incoming Brotli-compressed requests from untrusted sources, or switch off Brotli decoding until fixes are in place.

For everyday users:

• Accept software updates for apps, media tools and developer runtimes as they arrive. Many products embed Brotli without advertising it.
• Be cautious with image and media files from unknown sources until the tools you use to open them have been updated.

What we still don't know

• Why the February source-code fix was not flagged as a security issue sooner, and why no new Brotli release followed it.
• Exactly which configurations make remote code execution, rather than just crashes or data leaks, realistically possible.
• How many commercial and embedded products bundle a vulnerable Brotli copy and have not yet shipped fixes.
• Whether the public exploits will lead to real-world attacks, and how quickly.
• Whether the "critical" label or Microsoft's 8.1 score better reflects the risk across all affected products.

ITVedas analysis: Broccoli2Shell shows how a quiet fix in a shared library can stay unnoticed for months while vulnerable copies spread through countless products. Organisations that cannot say which of their software bundles Brotli now face the hardest part of the cleanup. Building an accurate inventory of software components is no longer optional.