Michael JohnsonAn application can receive ordinary HTTPS traffic and still process dangerous input if it decompresses Brotli data supplied by users. On October 25, 2026, Microsoft released out-of-band .NET updates to address a buffer overflow in the Brotli decoder; the vulnerability is designated CVE-2026-111497. Node.js included a fix for the same vulnerability in a separate security release on October 21. For developers, the first step is to trace the path from external data to the decoder, then update the runtime and rebuild or restart the application.
According to Microsoft’s description, the .NET vulnerability could allow an unauthenticated attacker to read or corrupt process memory, potentially resulting in data disclosure, denial of service, or privilege escalation. Fixes are available for .NET 8, 9, and 10, as well as .NET 11 Release Candidate 3. For .NET 8, the specified versions are runtime 8.0.33 and SDK 8.0.133 or 8.0.427. .NET Framework is not affected by this vulnerability.
Where exposure occurs
The risk arises when an application passes an untrusted Brotli stream to a vulnerable decoder. In .NET, this can happen when using ASP.NET Core request decompression, automatic response decompression through HttpClient, or direct calls to APIs in System.IO.Compression, such as BrotliStream and BrotliDecoder. The .NET advisory lists these paths and says that incoming request decompression and automatic response decompression are disabled by default.
Package inventory is only the beginning of the check. Look for middleware and HTTP client configurations, direct decoder calls, and third-party components that accept compressed data. Determine whether such data comes from clients, webhooks, proxies, or external APIs, and what size and processing-time limits are applied before decompression. This helps identify where vulnerable code receives externally controlled data.
Updating .NET
Install the update for the branch you use: .NET 8—8.0.33, .NET 9—9.0.22, .NET 10—10.0.14; for .NET 11, use Release Candidate 3. For framework-dependent applications, install the updated runtime and restart the application. Self-contained applications must be rebuilt and republished: updating the runtime on the host does not replace the copy bundled with the application. Rebuild containers and deploy them using updated .NET images.
For NativeAOT, also use updated SDKs and runtime packages when publishing again. If you cannot deploy the fix yet, temporarily disable Brotli on identified input paths that accept untrusted data. Test regular requests and integrations: disabling compression may change how clients that send compressed bodies are handled.
Check Node.js and system dependencies
The Node.js project reported the vulnerability on October 21: the Brotli decoder bundled with Node.js 22.x, 24.x, and 26.x is affected. The Node.js security release lists the fixed versions as 22.23.4, 24.22.1, and 26.12.1, respectively. Update to the supported branch you use and restart the service. According to the project, the issue occurs when an application decompresses attacker-supplied data using node:zlib; memory corruption can lead to a crash, memory disclosure, or remote code execution.
Also check dependencies shipped separately from the system Node.js or .NET installation. Verify Brotli versions in containers and build artifacts, then repeat the check after deployment. In CI, pin the updated base image and include version checks for vulnerable libraries in the regular build process.
Quick action plan
- List applications, SDKs, runtimes, containers, and NativeAOT builds that use Brotli.
- Find where external data passes through automatic or direct decoding.
- Update .NET, Node.js, and separately shipped libraries to fixed versions; rebuild self-contained applications and containers.
- Restart processes and check versions in the running environment, not just in project files.
- Until the fix is deployed, restrict the handling of untrusted Brotli input on identified vulnerable paths.
Priority depends on two factors: whether a vulnerable component is present and whether a specially crafted compressed stream can be passed to it. Updating closes the defect, while mapping input paths helps ensure the fix reaches processes, self-contained builds, and containers.