A critical flaw in Google's Brotli decoder (CVE-2026-111497, "Node2Shell") lets crafted compressed data corrupt memory. It affects websites, APIs and scripts in Node.js, .NET or Python that decompress Brotli from third parties. Node.js shipped patches on 21 October and Microsoft on the 25th: update today or ask your provider to confirm it.
Key facts
- CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. Google rates it CVSS 4.0 9.2 (critical) and Microsoft CVSS 3.1 8.1: critical for .NET and Visual Studio, important for PowerShell.
- It affects Brotli 1.0.3 to 1.2.0. Fixed versions 1.0.10, 1.1.1 and 1.2.1 were released on 21 October.
- Node.js fixed it in 22.23.4, 24.22.1 and 26.12.1. Node.js 20 and earlier are out of support and will not be patched.
- On 25 October Microsoft released .NET 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 RC3, and updated Visual Studio and PowerShell. .NET Framework is not affected.
- No real-world exploitation has been reported, but Microsoft marks it as "Exploitation More Likely" and publicly disclosed.
Am I affected if I don't know whether my app uses Brotli?
You need to check. The risk appears when a service decompresses Brotli coming from outside: a response from another site or a request body. According to SecurityWeek, Imperva achieved code execution on the official Node.js 24.22.0 image for Linux arm64, both with a response fetched via fetch() and with a request body in Express 5. The exploit has not been published.
In Python the problem is quieter. If Brotli or brotlicffi is installed, HTTP clients such as requests, urllib3, httpx and aiohttp decode Brotli responses on their own, without anyone coding it. According to The Hacker News, dependency scanners may not detect this yet. Fixed versions are Brotli 1.2.1 and brotlicffi 1.2.1.0.
.NET is in a somewhat better position: Microsoft says Brotli decompression is not enabled by default in .NET or ASP.NET Core. Even so, it rates the patch as critical.
What if I only use WordPress, Microsoft 365 or SaaS?
If you have no custom code, your direct risk is low. Your providers may still be exposed, though. The flaw also reaches Bun (fixed in 1.4.4), Envoy and Istio, which already have updates. JFrog reported on 25 October that it affects FFmpeg, ClickHouse and Apache Arrow, and that some of them had no fixed version yet. Ask your development agency and your hosting provider whether they have updated.
Is updating the server enough?
Not always. Self-contained or NativeAOT .NET apps carry the runtime inside, and so do container images. They must be rebuilt and redeployed. Node.js has no internal mitigation: updating is the only fix.
What to do today
- Take inventory: which custom websites, APIs, shops or back offices you run on Node.js, .NET or Python, and who maintains them.
- Ask for written confirmation of these versions: Node 22.23.4, 24.22.1 or 26.12.1; .NET 8.0.33, 9.0.22 or 10.0.14; Brotli or brotlicffi 1.2.1.
- Require self-contained or NativeAOT .NET apps and container images to be rebuilt and redeployed.
- If you can't update yet, reject requests with
Content-Encoding: brat the proxy or web application firewall. - In Python, uninstall Brotli and brotlicffi if you don't need them.
- If anything runs on Node 20 or earlier, set a date to migrate to a supported version.
- Update Visual Studio and PowerShell on your technical team's machines.
What it means for a small business
This is not an active-exploitation emergency, but it isn't something to leave until next month either. Three signals point that way: a code execution demo already exists, Microsoft considers exploitation likely, and the window between patch and attacks tends to be short.
The tricky part is that many small companies don't know what technology runs underneath their website, shop or integrations. That blind spot is the real risk. If your provider replies "everything's fine" without giving specific versions, they haven't answered you. Ask for numbers.
Node 20 deserves separate attention. If your app depends on an unsupported version, this flaw won't get a fix, and neither will the next one. That's technical debt that now carries a security cost. If you need to sort out that inventory and see what you have exposed, that's the kind of review we do in cybersecurity.
FAQ
Is it being exploited already?
No real-world exploitation has been reported. There is a code execution demo on Node.js, but the exploit has not been published.
Does it affect .NET Framework?
No. According to Microsoft, .NET Framework is not affected. The patches cover .NET 8, 9, 10 and .NET 11 RC3.
Can I mitigate it without updating Node.js?
Not within Node.js. As a stopgap, you can reject Content-Encoding: br at the proxy or web application firewall.
Sources
- Microsoft Security Update Guide – CVE-2026-111497
- The Hacker News – Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- SecurityWeek – Node2Shell Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
- The Hacker News – Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions
