Brotli Flaw Now Under Active Attack: Patch Node.js and .NET

Singapore's Cyber Security Agency (CSA) has issued a fresh alert on CVE-2026-111497, the critical out-of-bounds write bug in the Brotli decompression library, warning that the flaw now has a public proof-of-concept exploit and is "reportedly being actively exploited" in the wild — and that it affects Microsoft .NET as well as Node.js. The agency's alert, published October 30, 2026, lists a CVSS v3.1 base score of 9.8 and says organizations should patch immediately. Fixed Node.js releases are 22.23.4, 24.22.1, and 26.12.1; Microsoft has separately shipped out-of-band .NET updates.

What Singapore's CSA alert confirms

CSA's advisory, numbered AL-2026-154, confirms that CVE-2026-111497 — the Brotli decoder out-of-bounds write that Node.js patched on October 27 — now carries a public proof-of-concept exploit and "is reportedly being actively exploited in the wild." That phrasing matters: CSA is relaying reported exploitation activity rather than asserting it has independently verified compromises, and the alert does not cite a specific confirmed breach or name a threat actor. The agency's own language is the most honest way to describe where things stand on October 30: a working PoC is public, and there are reports of attackers using it, but the alert stops short of calling it a fully confirmed, documented in-the-wild campaign.

What the CSA alert does say plainly is the severity: a CVSS v3.1 base score of 9.8, which it classifies as critical, and a recommendation to "patch immediately." The alert also broadens the scope of the story that broke on October 27 — when Pandromeda's software desk first reported Node.js's patch for the flaw — by explicitly naming Microsoft .NET versions 8, 9, 10, and 11 as affected, not just Node.js.

CVE-2026-111497 at a glance

The bug sits in the Brotli decoder bundled with both runtimes. Malformed compressed input can cause the decoder to write past the end of an internal buffer, corrupting adjacent process memory. Depending on what an application does with that corrupted memory, the result can range from a crash to disclosure of sensitive data to remote code execution. Node.js's own security advisory describes the root cause as an invalid block switch in the decoder being treated as a signal that more input is needed, rather than as a permanent format error — so a streaming decoder keeps appending attacker-controlled bytes to a fixed-size buffer well past its end.

Note the severity discrepancy above: CSA's alert cites a 9.8 CVSS v3.1 score for the vulnerability generally, while Microsoft's own GitHub security advisory for the .NET-specific impact scores it at 8.1 (High) under the same CVSS v3.1 standard. Both figures come from primary sources; the difference likely reflects different scoring of exploit prerequisites and impact across the two ecosystems, and readers should treat both as accurate representations of their respective publishers' assessments rather than a contradiction to resolve in favor of one.

Affected and fixed Node.js versions

Node.js's security team shipped fixes for all three currently supported release lines on October 27. Any application running a Node.js build older than the versions below remains exposed if it decompresses Brotli data through the built-in node:zlib module, including Brotli-compressed responses handled automatically by fetch().

• Node.js 22.x: upgrade to 22.23.4 or later
• Node.js 24.x: upgrade to 24.22.1 or later
• Node.js 26.x: upgrade to 26.12.1 or later

The flaw was reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer, and fixed by Node.js collaborators Matteo Collina and Antoine du Hamel, according to the project's own vulnerability advisory. No workaround exists beyond upgrading; teams that cannot immediately update should, at minimum, avoid decompressing Brotli data from untrusted sources with node:zlib.

.NET is also affected — this is the new part of the story

The detail that separates this follow-up from the original Node.js patch announcement is CSA's confirmation that CVE-2026-111497 reaches well beyond the JavaScript runtime. Because the underlying flaw lives in Google's open-source Brotli library, any project that bundles an affected copy of that code can inherit the bug — and Microsoft's .NET is one of them.

Microsoft published its own GitHub security advisory for the issue, rating it CVSS v3.1 8.1 (High) and confirming the affected and patched version ranges directly:

Microsoft shipped these as an out-of-band release on October 25, 2026 — two days before Node.js's own public disclosure — through the .NET blog. According to both Microsoft's advisory and its blog post, a .NET application is exposed only if it actually decompresses attacker-controlled Brotli data, such as through ASP.NET Core request decompression, HttpClient automatic response decompression, or direct use of BrotliStream or BrotliDecoder. Request decompression and automatic response decompression are not turned on by default in ASP.NET Core, which narrows real-world exposure somewhat, though plenty of APIs do enable them. The .NET Framework (as opposed to modern .NET) is not affected.

Is the flaw actually being exploited?

This is the question search traffic is clearly asking, and the honest answer requires sticking close to CSA's exact wording. The alert's own "Known Exploitation" section states the vulnerability "is reportedly being actively exploited," paired with confirmation that a proof-of-concept exploit is publicly available. CSA does not cite a specific incident, victim, or threat-intelligence source for that exploitation claim in the alert text, and it does not claim to have independently verified a compromise.

In practical terms: treat "reportedly being actively exploited" as a serious, credible warning from a national cybersecurity agency that attackers have moving pieces — a working public exploit plus some level of reported real-world use — not as a formal, attributed confirmation of a specific breach. Either way, the combination of a 9.8-rated flaw, a public PoC, and a government advisory telling organizations to patch immediately is reason enough to treat this as an emergency patching event rather than routine maintenance.

Why a Brotli decoding bug is so severe

Brotli is a general-purpose compression format that both Node.js and .NET bundle to handle compressed HTTP traffic. Because decompression routines process untrusted, attacker-supplied bytes by design, a memory-safety bug in the decoder gives a remote, unauthenticated attacker a direct path into the host process — no login, no social engineering, just a malicious compressed payload sent to anything that decompresses it. That is precisely the pattern described in Node.js's own advisory and echoed in Microsoft's: out-of-bounds memory writes triggered purely by malformed compressed input, with a potential outcome of memory corruption, information disclosure, denial of service, or remote code execution.

That combination — low attacker effort, high potential impact, and now a public exploit — is also why this bug has been widely nicknamed "Node2Shell" in security research circles, underscoring how a compression-library bug can translate into shell-level compromise if left unpatched.

It is also worth understanding why a single flaw ended up patched twice, three days apart, by two unrelated vendors. Node.js and .NET do not share a codebase; they each bundle their own copy of Google's open-source Brotli decompression library to handle compressed HTTP traffic efficiently. When the underlying Brotli bug was found, every downstream project carrying an affected copy of that code inherited the same out-of-bounds write — which is also why reporting on this flaw has mentioned other affected software beyond Node.js and .NET, including Python packages and other runtimes that bundle Brotli. That shared-dependency pattern is a recurring theme in modern software supply chains: a single flaw in a widely reused compression, parsing, or serialization library can ripple across completely unrelated ecosystems within the same week.

Who is at risk

• Any Node.js service running 22.x before 22.23.4, 24.x before 24.22.1, or 26.x before 26.12.1 that decompresses Brotli data via node:zlib or via fetch() responses
• Any ASP.NET Core or .NET application on an unpatched 8, 9, 10, or 11 build that enables request decompression, relies on HttpClient's automatic response decompression, or calls BrotliStream/BrotliDecoder directly on untrusted input
• Self-contained .NET apps and containers that bundle their own runtime — these do not pick up the fix automatically from a host OS or framework update and must be rebuilt and redeployed
• Internet-facing APIs, reverse proxies, and CDNs that accept Brotli-encoded request or response bodies from clients

How to patch Node.js and .NET

For Node.js, update to the fixed line for your major version: 22.23.4, 24.22.1, or 26.12.1. Most teams can do this through their usual Node version manager or container base-image update, followed by a redeploy and restart of affected services.

For .NET, Microsoft's guidance is specific: installing an updated host runtime is not enough for self-contained deployments. Framework-dependent apps pick up the fix once the shared runtime is updated and the app is restarted, but self-contained apps and containers bundle their own copy of the runtime and must be rebuilt against the patched SDK (8.0.33, 9.0.22, 10.0.14, or 11.0.0-rc.3) and redeployed. Container images built on affected .NET base images need to be rebuilt from updated images as well.

Teams managing other internet-facing infrastructure during the same patch cycle may find it useful to compare this to other recent emergency fixes, such as the VMware ESX logging flaw patched under CVE-2026-41709 or the Cisco ASA/FTD VPN flaw tracked as CVE-2026-76418, both of which followed a similar pattern of urgent out-of-band patches.

If you can't patch immediately

Neither Node.js nor Microsoft has published a workaround beyond upgrading. If an immediate update genuinely is not possible, the only meaningful interim step is to reduce exposure to attacker-controlled Brotli data: disable automatic request/response decompression where it is not strictly required, place a filtering proxy in front of services that must accept compressed uploads from untrusted clients, and monitor for process crashes or anomalous memory behavior in services that handle compressed traffic. These are stopgaps, not fixes, and given CSA's "patch immediately" guidance and the public availability of exploit code, they should be treated as a bridge to patching within hours, not days. Organizations that run vulnerability scanning or asset-management tooling should also check whether those tools have been updated to detect the specific Node.js and .NET version ranges listed above, since generic "Brotli" or "Node.js" signature matches can miss version nuances like the .NET 11 preview/RC range or self-contained deployments that bundle an outdated runtime copy.

What next

Expect this story to keep moving. CSA's alert was published October 30, three days after Node.js's patch and five days after Microsoft's out-of-band .NET release, and other national CERTs and vendors that bundle the Brotli library are likely to issue their own advisories as the public PoC circulates further. Security teams should prioritize an inventory check now: identify every Node.js and .NET service in their environment, confirm its exact version against the fixed builds above, and patch or rebuild anything that falls short — treating this as equivalent in urgency to any other critical, publicly-exploited remote code execution bug landing on a CVSS 9.8 alert from a national cybersecurity agency.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage