security
Redmond joins growing list of software makers scrambling to fix compression flaw
To address a vulnerability in Google’s Brotli compression technology that could allow attackers to corrupt process memory, Microsoft is urging .NET users to update “as soon as possible” after releasing an out-of-band (OOB) security update.
It released new versions for .NET 8, 9, 10 and .NET 11 to fix the Brotli bug, following similar updates to Node.js, Python and other projects.
Senior program maintainer Rahul Bhandari said in the October 25 release that the buffer overflow vulnerability in Brotli, identified as CVE-2026-111497 and rated 8.1 under CVSS v3.1 in Microsoft’s advisory, could allow an unauthenticated attacker to read or corrupt process memory, which could lead to information disclosure, denial of service, or escalation of privilege.
Microsoft’s own advisory regarding the vulnerability, which some call Broccoli2Shell or Node2Shell, confirms that while experts have cobbled together working exploits, there is no indication that criminals are using them in successful attacks.
However, its exploitability assessment reads: “Exploitation more likely.”
Broccoli2Shell was first disclosed on October 21 by the Node.js team, which released fixes for ten vulnerabilities, the most serious of which was CVE-2026-111497.
Node.js credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security for the discovery, but failed to mention why it was only recognized as a security flaw and properly disclosed in October, although the underlying bug was fixed in Brotli’s source code in February.
OpenAI filled the gap with a
“Since Brotli is integrated with other software, any software that includes this library must also perform the update, followed by users of that software.”
Attackers can exploit vulnerable systems by providing them with malicious data compressed by Brotli via a specially crafted request.
The vulnerability has flown slightly under the radar due to the disclosure timeline closely aligned with that of PHP2Shell, although patching the critical flaw is expected to be a priority due to the range of technologies affected.
In addition to .NET, Node.js, and Python, Bun, Envoy, and Istio have all released patches, and JFrog has crafted an exploit affecting FFmpeg using a specially crafted JPEG XL image, extending the exploit’s path beyond HTTP.
He said that FFmpeg reaches Brotli via libjxl, which it uses to decompress metadata stored in brob boxes into image format.
The same researchers said the vulnerability also affects Apache Arrow, with attackers able to cause a denial of service.
Merav Bar, threat researcher at Wiz, added that cloud users are widely exposed, noting that 91% of cloud environments rely on components vulnerable to the Brotli flaw and that 82% of cloud environments have publicly exposed Node.js instances.
She said: “Cloud environments are particularly exposed due to the widespread use of Brotli-enabled components in containerized applications, Kubernetes clusters, API gateways, reverse proxies, serverless workloads and cloud-hosted web services.
“Successful exploitation could allow attackers to compromise application workloads, access sensitive information, disrupt service availability, or execute malicious code in affected containers or runtime environments,” Bar added.
In an advisory published as part of its Patch the Planet initiative, OpenAI recommended blocking untrusted data compressed by Brotli where possible until patches can be applied. It also advised managers to rebuild affected deployments and restart services to ensure the fixes take effect. ®
Gn tech
