Critical Brotli Flaw Prompts Microsoft and Node.js Patches

A critical flaw in the widely used Brotli compression decoder has prompted security updates for Microsoft development tools, Node.js and Python packages. It matters mainly to households and small offices that run software-development tools, servers or self-hosted services—not every Windows PC—but affected systems could crash, expose memory or run an attacker’s code after processing malicious compressed data.

What happened

The vulnerability, identified as CVE-2026-111497 and nicknamed Node2Shell, is an out-of-bounds write affecting Brotli versions 1.0.3 through 1.2.0, according to SecurityWeek. Specially prepared data can cause the decoder to write beyond its assigned memory space.

The resulting corruption may crash a program, reveal information from memory or allow code execution without authentication. The malicious data must reach an affected decoder, such as through a compressed web request, a response downloaded from an untrusted server or a compressed file.

Imperva demonstrated code execution against the official Node.js 24.22.0 image for Linux on Arm64 under specific application setups. The test did not succeed every time, and the company has not released its exploit. SecurityWeek reported no known attacks exploiting the flaw in the wild.

Google assigned the vulnerability a critical 9.2 score under CVSS version 4. Microsoft rated it critical for .NET and Visual Studio, and important for PowerShell.

Who is affected

The clearest risk is to developers, home-server operators and small offices running affected software. Microsoft issued updates on October 25 for .NET, Visual Studio and PowerShell. Node.js and the Python Brotli packages were patched earlier, while Bun, Envoy and Istio also received updates.

For Python users, the fixed releases are Brotli 1.2.1 and brotlicffi 1.2.1.0. Microsoft’s updated .NET runtime releases include 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3. Visual Studio 2019, 2022 and 2026 and the PowerShell 7.4, 7.5 and 7.6 release families have updates available.

A public tracker also lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II among projects that remained unpatched at publication time. That list is incomplete, and not every installation necessarily exposes the vulnerable decoder.

What to do now

1. Inventory development and server software. Check household PCs, home servers and small-office systems for .NET, Visual Studio, PowerShell 7, Node.js, Bun, Envoy, Istio and Python projects using Brotli or brotlicffi.

2. Install Microsoft’s October 25 security updates. Update supported .NET runtimes, Visual Studio installations and PowerShell 7 release families through each product’s normal update mechanism.

3. Update Node.js and Python dependencies. Move Node.js to its current patched release. For Python projects, install Brotli 1.2.1 or brotlicffi 1.2.1.0 as applicable.

4. Check bundled copies of Brotli. Updating a system library may not fix an application that ships its own decoder. Confirm that each affected project specifically includes the Brotli correction.

5. Handle untrusted compressed content cautiously. Until an affected application is patched, avoid feeding it compressed files, web responses or request bodies from unknown sources.

6. Restart and rebuild. SecurityWeek says running processes keep using the old code. Restart updated services and rebuild container images from a patched base after installing fixes.