Microsoft has released an emergency, out-of-band security update for .NET after a critical flaw was found in the widely used Brotli compression library. The update, issued on 25 October 2026, covers .NET 8, 9 and 10, along with .NET 11 Release Candidate 3, as well as Visual Studio and PowerShell builds that use the affected code.

What the Brotli flaw allows

The flaw, tracked as CVE-2026-111497, is an out-of-bounds write in the Brotli decoder. In plain terms, a specially crafted compressed stream can corrupt process memory. Microsoft says an unauthenticated attacker could read or corrupt memory, leading to information disclosure, denial of service or privilege escalation. Node.js researchers have described the wider issue, nicknamed Node2Shell, as capable of remote code execution in some configurations. The flaw affects Brotli versions 1.0.3 through 1.2.0. Fixed Brotli releases are 1.0.10, 1.1.1 and 1.2.1. Microsoft says applications are at risk when they process Brotli-compressed data through ASP.NET Core request decompression, HttpClient automatic response decompression, or the System.IO.Compression Brotli APIs, although request and automatic response decompression are not enabled by default.

Why teams should not wait

This is not a .NET-only problem. Node.js shipped fixes on 21 October, and Python packages have also been updated, because Brotli is often pulled in indirectly through HTTP clients and other libraries. The same update also re-issues fixes for two October Patch Tuesday flaws that Microsoft says were not fully addressed the first time. Teams should update, restart affected services, and check whether bundled or containerised copies of Brotli are still on a vulnerable version.