Microsoft issues emergency .NET patches for critical Brotli decompression flaw

Apps that bundle their own copy of the library need separate updates, not just a system library fix.

A memory-corruption flaw in Google's Brotli decompression library, tracked as CVE-2026-111497 and nicknamed Broccoli2Shell, Node2Shell or HTTP2Shell, has prompted emergency patches from Microsoft for .NET. A crafted compressed stream can crash a process, leak memory or, in some configurations, allow remote code execution, and Microsoft says unpatched .NET systems with non-default settings can see privileges escalated remotely. Affected Brotli versions include 1.0.3 through 1.0.9, 1.1.0 and 1.2.0, and the same bug reaches Node.js and Python HTTP clients that use a vulnerable decoder. Microsoft's fixed releases are .NET 8.0.33, 9.0.22 and 10.0.14, with .NET 11 Release Candidate 3, while Node.js 22.23.4, 24.22.1 and 26.12.1 and Brotli 1.0.10, 1.1.1 and 1.2.1 carry the upstream fixes. Proof-of-concept exploits are public, though no in-the-wild abuse has been reported, and developers should restart processes and rebuild containers after updating. Teams that cannot patch yet should block Brotli-compressed inbound requests at a proxy or firewall, or disable Brotli decoding, since updating the system library does not cover apps that bundle their own copy.