Brotli flaw widens urgent patching beyond Node.js as Microsoft issues out-of-band updates

Microsoft's emergency release expands the response

Microsoft released out-of-band .NET security updates on October 25 for CVE-2026-111497, a memory-corruption flaw in Google's Brotli decoder. JPCERT/CC followed with an October 26 alert. The development extends an existing patching effort across software ecosystems rather than marking a newly discovered vulnerability or a confirmed wave of attacks. [1][2][8]

Google's Brotli project and Node.js released fixes on October 21; GitHub's reviewed advisory incorporated affected Python packages on October 23. These primary product disclosures corroborate the shared-component problem across implementations. They do not independently establish successful attacks against every affected product. [3][5][7][8]

Exposure depends on what the application decodes

Node.js explains that the decoder treated an invalid block switch as a temporary need for more input instead of a permanent format error. The streaming decoder could then continue appending bytes to an eight-byte internal buffer, corrupting memory. Possible consequences include crashes, disclosure of process memory and code execution. [7]

The decisive condition is whether attacker-controlled compressed data reaches that decoder. Imperva tested malicious responses consumed through Node.js fetch() and incoming requests processed by configured Express/body-parser middleware. A bare Node.js HTTP server does not automatically decompress incoming Brotli bodies. Microsoft likewise says ASP.NET Core and HttpClient do not automatically decompress Brotli by default: exposure requires enabling that functionality or explicitly decoding untrusted data. [4][8]

A successful experiment is not a universal exploit

Imperva reports code execution on the official Node.js 24.22.0 Linux arm64 container image without a debugger or instrumented binary. The patched 24.22.1 image rejected the same inputs. Success required multiple attempts, however, and the researchers did not establish equivalent results for every architecture, build or application configuration. [4]

SecurityWeek's October 26 article connects the downstream releases and reports that no exploitation in the wild had been reported. It is separately authored reporting, not an independent reproduction of Imperva's experiment. Bun's maintainers explicitly say they had not tested an attack against Bun. Neither source establishes a victim count or universally reliable exploit. [6][9]

Severity assessments also differ. GitHub's reviewed advisory assigns Critical, CVSS v4.0 9.2; Red Hat assigns Important, CVSS v3.1 8.1, citing attack complexity and platform hardening. Red Hat says there is no public, reliable remote-code-execution proof of concept. Those different scoring systems and deployment assumptions should not be flattened into a universal rating, nor should the limited experiment be treated as reliable exploitation everywhere. [5][12][4]

Fixed versions span runtimes, packages and branches

The fixed supported Node.js releases are 22.23.4, 24.22.1 and 26.12.1. For Python dependencies, GitHub identifies fixes in brotli 1.2.1 and brotlicffi 1.2.1.0. These are package-specific findings, not evidence that every Python installation is exposed. Bun's fix is 1.4.4; its advisory covers versions from 1.0.21 up to, but excluding, that release. [5][7][9]

Microsoft lists fixes in .NET 8.0.33, 9.0.22, 10.0.14 and the .NET 11 preview release 11.0.0-rc.3.26522.148. Its advisory covers affected decoder/runtime and NativeAOT packages. .NET Framework is unaffected, an important distinction when inventorying Microsoft application estates. [8]

Upstream Brotli fixes exist in 1.0.10, 1.1.1 and 1.2.1, so an older version number does not automatically mean an unpatched installation. AWS's October 26 Amazon Linux 2023 advisory likewise provides corrected packages retaining an upstream 1.1.0 version component. Assess distribution packages against vendor advisories, rather than a blanket rule that anything below 1.2.1 is vulnerable. [2][13]

Updating the host may leave embedded decoders behind

Microsoft's deployment guidance makes the distinction between shared and embedded runtimes operationally important. For self-contained and NativeAOT applications, updating the machine's shared runtime does not replace the application's embedded decoder. Those applications require rebuilding and redeployment. Bun similarly requires compiled executables containing an older runtime to be rebuilt with a fixed version. [8][9]

Verification must reach the running workload. Azure's Node.js guidance warns that configuration settings and a separate console process do not prove which runtime an application actually uses. Check scaled-out instances and customer-supplied containers. Our operational inference is that a successful package update alone is insufficient closure evidence when deployed applications can retain their own runtime. [11][8][9]

Temporary controls must cover requests and responses

While patching, Red Hat recommends restricting exposed decoding services and avoiding automatic decoding from untrusted sources. Bun documents request-specific disabling of response decompression but warns that affected releases have no process-wide workaround. Imperva's two tested paths show why an inbound-only control leaves a gap when an application also fetches attacker-controlled compressed responses. [12][9][4]

Unexpected exits and decoder errors warrant investigation, but they are not reliable standalone indicators of exploitation. Imperva recommends correlating those symptoms with application logs, runtime versions and the compressed-data source. That supports focused triage without treating every crash as proof of intrusion or interpreting the absence of reported attacks as proof of safety. [4][6]

Watch reachable workloads and exploitation evidence

Wiz reports vulnerable resources in 91% of cloud environments in its data, but its article provides insufficient sampling detail to establish representativeness. The figure measures neither compromised organizations nor remotely reachable decoders. Read alongside the vendors' configuration caveats, it supports dependency discovery, not a claim that nearly every cloud environment can be exploited remotely. [10][8][4]

Our assessment is that the next material developments would be verified exploitation outside research, reproducible results across additional platforms, or further downstream remediation guidance. For defenders, the immediate priority is narrower and testable: identify untrusted Brotli decoding paths, deploy the applicable fixes and verify the runtime actually serving each workload. [4][6][8][9][11]