Microsoft shipped .NET fixes on a Sunday. Node and Python had the same Brotli bug.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Sunday 25 October 2026, Microsoft released out-of-band .NET 8.0.33, 9.0.22 and 10.0.14 for four CVEs, among them CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder. Node.js fixed it on 21 October in 22.23.4, 24.22.1 and 26.12.1, and the Python brotli package in 1.2.1, SecurityWeek reports. No attacks are reported yet.
Why it matters
Brotli is the br in your Content-Encoding header. One malformed compressed body can crash the decoder or leak memory, and Node.js says code execution is possible. In .NET it bites only where you turned on Brotli decompression or call BrotliStream on untrusted data.
What to do
Upgrade the .NET runtime and SDK, Node.js and the Python brotli packages, then rebuild container images, self-contained and NativeAOT apps. Restart every service after, since running processes keep the vulnerable decoder.
My take
Lior Aharonov
Founder, 7IT Solutions
Nobody puts a compression library on the risk register. That's exactly why I check it first.
I've seen this before
I've seen this movie with Log4Shell in 2021. CISA warned that Log4j was very broadly used and could hide inside SaaS, cloud resources and internally developed software. The patch was the easy part; finding every copy was the job.
Sources
Researched with AI tools; every fact is checked against the linked sources.