Hackers are already exploiting the Brotli flaw, the compression that speeds up your websites

On Sunday, October 25, Microsoft released a .NET update it had not planned. Among the four vulnerabilities fixed, one does not come from Microsoft: CVE-2026-111497, a flaw in Brotli, Google's compression library that lets websites deliver their pages faster. Two days later, on October 27, the US cybersecurity agency (CISA) added it to its catalog of vulnerabilities exploited by hackers.

Nicknamed “Node2Shell” and first spotted in the Node.js JavaScript environment, the flaw lies in Brotli's decoder. According to BleepingComputer, an attacker with no privileges can send a booby-trapped compressed stream that crashes the program or makes it leak memory. In some cases, the attacker can also execute code remotely. CISA says nothing about the attacks it has observed: neither who is behind them, nor which targets they hit.

Far more than Node.js

Brotli is built into many pieces of software: web servers and clients, Python libraries, .NET. We previously explained how the flaw could affect your Python applications and how, in Node.js, simple compressed data could be enough. With exploitation now confirmed, the question is no longer whether you are theoretically exposed, but where the vulnerable copies of the library are hiding.

US federal civilian agencies have until November 10 to patch. CISA is urging all organizations to do the same as a priority.

The updates to install

• Node.js: versions 22.23.4, 24.22.1 or 26.12.1, released on October 21. Node.js 20, which has reached end of life, will not receive a patch.
• .NET: version 8.0.33, 9.0.22 or 10.0.14 depending on your branch, released on October 25. Microsoft asks that you install it even if you applied the October 13 update.
• Brotli itself: versions 1.0.10, 1.1.1 or 1.2.1 of the library, for software that uses it directly or bundles it.

If you can't patch today

As is often the case with a widely used library, the patch is not enough if it doesn't reach every copy. According to BleepingComputer, while waiting for the update, you can block incoming Brotli-compressed requests at the proxy or firewall level, or disable Brotli decoding. Once the patch is installed, you need to restart the affected processes, then rebuild and redeploy any container images that bundle a vulnerable version: updating the host machine is not enough.

What remains unclear is what attackers are doing with this flaw. Until CISA or a vendor publishes details about the attacks, there is no way to tell whether it is being used to steal data, install backdoors or merely take services down.