Brotli flaw hits Node.js, .NET and PowerShell at the same time

A memory-corruption flaw in Google's Brotli compression library has set off a patching chain that runs from Node.js through Microsoft .NET to Python packages and Visual Studio. Tracked as CVE-2026-111497 and nicknamed "Node2Shell," the bug carries a CVSS 4.0 score of 9.2 from Google. Microsoft rated the same issue 8.1 on CVSS 3.1 for its own products, marking it critical for .NET and Visual Studio.

Technically, the flaw is an out-of-bounds write in the Brotli decoder. When specially crafted compressed data reaches the decoder, the process can crash, memory contents can leak, or an unauthenticated attacker can run arbitrary code. The attack surface is compressed HTTP request bodies, responses from untrusted servers, and compressed files.

Why it matters

The hard part is that this is not one product you patch. Brotli ships embedded inside applications, so "which server do I update" does not have a single, tidy answer. According to SecurityWeek, affected Brotli versions run from 1.0.3 through 1.2.0, with fixes published in 1.0.10, 1.1.1 and 1.2.1.

• Node.js: the 21 October 2026 security releases delivered 22.23.4, 24.22.1 and 26.12.1. Qualys notes that the 25.x, 23.x, 21.x and 20.x lines have no fix at all — those installations need to move to a supported line.
• Microsoft: on 25 October 2026 it shipped .NET 8.0.33, 9.0.22, 10.0.14 and .NET 11 RC3, along with Visual Studio 2019, 2022 and 2026. PowerShell 7.4, 7.5 and 7.6 are on the list too.
• Python: fixed releases are Brotli 1.2.1 and brotlicffi 1.2.1.0 on PyPI. Bun, Envoy and Istio have also published updates.

A public tracker lists DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II as still unpatched, with maintainers noting the list is incomplete. The reassuring part: SecurityWeek reports no exploitation in the wild so far. Imperva demonstrated code execution against the official Node.js 24.22.0 Linux arm64 image but said the attempts did not always succeed, and it has not published its exploit.

What this means for smaller companies

Most small and mid-sized firms do not install Node.js or .NET themselves — these arrive underneath a website, an ERP front end, a customer portal or a supplier's application. In practice the exposure sits in internet-facing web application servers, API endpoints and reverse proxy layers. There is a second point worth stating plainly: if you did not build the software, you cannot apply the patch either. In that case the obligation sits with your vendor, and your job is to get a date from them.

What we recommend at Kamer Bilişim

• Inventory first, then plan the patching. List which Node.js and .NET versions run on which servers. Prioritise anything reachable from the internet; internal systems can follow in a second wave.
• Put the question to your vendor in writing. For any web software, ERP or portal you bought in, ask for the date of a release updated against CVE-2026-111497. That exchange also serves as a record for your data security obligations under Turkish data protection law.
• Put end-of-life versions on the agenda. No fix is being issued for Node.js 20.x and earlier. If an application of yours runs on one of those lines, what you need is an upgrade plan rather than a patch — and handling it inside a budget cycle costs considerably less than an emergency response later.

If you would like help building a server inventory, preparing a patching plan or chasing vendors — at your office or production site across the Anatolian side of Istanbul, or remotely — you can reach us through our contact page.

Source: SecurityWeek, 26 October 2026; Qualys Blog, 23 October 2026