Vulnerability in Brotli compression algorithm

Microsoft has released security patches for .NET to address a vulnerability in Brotli, a widely used compression algorithm. The vulnerability, known as CVE-2026-111497, was fixed by the Node.js teams and Brotli developers on October 21.

Flaw nicknamed Node2Shell or Broccoli2Shell

The flaw is nicknamed Node2Shell or Broccoli2Shell and affects the decoder of the compression algorithm designed by Google. It also impacts .NET, the Microsoft platform on which many software and web services rely, prompting Redmond to release emergency patches four days later. The cause is a memory management error that can have severe consequences for vulnerable applications.

Attack method and potential consequences

An attacker can transmit compressed data with Brotli that has been intentionally malformed to a .NET application, for example in a web request. If the application accepts to decompress them, the decoder integrated into .NET may continue processing despite the error and write beyond the memory area allocated to it. This out-of-bounds write can crash the program, expose sensitive information, or allow the attacker to obtain additional privileges on the system. The attack can be carried out remotely, without authentication or victim intervention.

Successful exploitation by researchers

On October 22, researchers from Imperva were able to exploit the same flaw to execute code on a vulnerable version of Node.js. By transmitting malformed Brotli data to their test application, they were able to make it create a file on the server, even though its code did not provide for such an action. By replacing this instruction with others, a hacker could access the sensitive data and secrets used by the application, or launch other commands with the rights it has.

Dependence on how .NET applications use Brotli

The exposure depends on how .NET applications use Brotli. Some ASP.NET Core servers can decompress the requests they receive, while software using HttpClient can automatically process compressed responses. Other applications directly call the Brotli functions of .NET. In the first two cases, developers must have enabled these functions, which are disabled by default. The vulnerability therefore concerns applications that decompress data that an attacker can control, while the old .NET Framework is not affected.

Microsoft provides updated versions of .NET

Microsoft has published versions 8.0.33, 9.0.22 and 10.0.14 of .NET, as well as the third Release Candidate of .NET 11, to fix the flaw. The affected teams must install these updates and restart their applications. When these applications include their own .NET environment, they must also recompile and redeploy them to integrate the patch. In the meantime, administrators unable to apply the patches immediately can disable Brotli decompression of data from untrusted sources.