The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
Node2Shell puts Microsoft and Node.js on Brotli patch duty
- Published
- Record updated
Summary
A vulnerability tracked as CVE-2026-111497 in Google's Brotli compression library lets attackers execute arbitrary code in applications that use an affected Brotli decoder to process compressed data. The flaw is an out-of-bounds write triggered by an invalid block switch, handled by the vulnerable DecodeBlockTypeAndLength() function, and the Node.js project disclosed it on October 21, 2026, alongside Microsoft's .NET updates and patched Python packages Brotli and brotlicffi.
Mitigation
Node.js fixed versions are 22.23.4, 24.22.1, and 26.12.1; upgrade to the relevant fixed release, rebuild affected container images, and redeploy applications that bundle vulnerable runtimes. Microsoft's October 25 updates fix .NET 8.0.33, 9.0.22, 10.0.14, and 11.0.0-rc.3.26522.148, and self-contained or Native AOT applications must be rebuilt and redeployed. Update Python packages to Brotli 1.2.1 and brotlicffi 1.2.1.0.