Microsoft has joined the maintainers scrambling to patch a flaw in Google’s Brotli compression library. The company released out of band updates for .NET 8, 9, 10 and 11 and urged users to update as soon as possible, The Register reported. The vulnerability, CVE-2026-111497, is a buffer overflow that could let an unauthenticated attacker read or corrupt process memory by supplying malicious Brotli compressed data, with potential information disclosure, denial of service or elevation of privilege. Microsoft rates it 8.1 under CVSS v3.1 and assesses exploitation as more likely, while noting working exploits have been demonstrated by researchers and there is no suggestion criminals are yet using them successfully.
The flaw, nicknamed Broccoli2Shell in some coverage, was disclosed on October 21 by the Node.js team, which credited Khai Tran and Sylvie Mayer of OpenAI’s Codex Security with the discovery. The underlying bug had been fixed in Brotli’s own source in February without being recognised as a security issue, and because Brotli is compiled into other software, every embedding project must ship its own update: Node.js, Python, Bun, Envoy and Istio have all released patches, and JFrog researchers demonstrated an exploit path through FFmpeg’s JPEG XL handling.
The exposure estimate is what makes this a sector story. Wiz researcher Merav Bar said 91 percent of cloud environments rely on components vulnerable to the flaw and 82 percent have publicly exposed Node.js instances, pointing to containerised applications, Kubernetes clusters, API gateways and serverless workloads. OpenAI’s Patch the Planet advisory recommends blocking untrusted Brotli compressed data where practical until patches are applied, and rebuilding and restarting deployments so fixes take effect.
Coming in the same week as the PHP2Shell KEV listing in today’s edition, the Brotli event is the second compression and runtime layer emergency in days. Neither flaw is in application code companies wrote; both are in the shared plumbing underneath it, which is why the patching burden lands on platform teams everywhere at once. This story is single sourced and graded accordingly.