Brotli vulnerability (CVE-2026-111497): update Node.js, .NET and PowerShell
You’ve probably never heard of Brotli. Yet it’s the compression tool that makes millions of websites and apps faster, and it’s now at the centre of an alert: the Brotli vulnerability CVE-2026-111497, nicknamed Node2Shell, Broccoli2Shell or HTTP2Shell, is being exploited by attackers. The US agency CISA added it to its catalogue of exploited vulnerabilities on Tuesday, October 27. The Canadian Centre for Cyber Security issued an alert on October 28, and so did Quebec’s CERT/AQ.
The catch for a small business: Brotli doesn’t get installed on its own. It comes hidden inside Node.js, .NET, PowerShell, Docker containers or vendor software. Here’s how to tell whether you’re affected, and what to fix first.
The Brotli vulnerability in plain terms
The flaw sits in Brotli’s decoder, the part that decompresses data. An attacker who gets your application to decompress booby-trapped data can write outside the intended memory area. According to the Cyber Centre’s alert, the attack works remotely and without a password, and can lead to a crash, leaked information from memory, or code execution.
The advisories describe two ways in:
- What you receive: a request sent to your application with Brotli-compressed content.
- What you fetch: your application downloads a Brotli-compressed response from a server the attacker controls. In Node.js, a simple fetch() call is enough to trigger the decoder.
Vendors don’t all rate it the same. Node.js calls it “high”, Microsoft scores it 8.1 out of 10 for .NET, and both the Cyber Centre and CERT/AQ call it critical. What matters: it’s being exploited, and the fixes are out.
Where Brotli can hide in a small business (from most visible to most buried)
Client portal, API, online quote tool, Next.js appnode -v
Only if Brotli decompression is enabled or used in the codedotnet –list-runtimes
Scripts that download files or call APIspwsh –version
An image built six months ago keeps its old versionimage build date
Envoy, Istio, Bun, the Brotli and brotlicffi packages, PHP Windows buildsask the vendor
List based on the Canadian Centre for Cyber Security alert and the CERT/AQ advisory. It is not exhaustive: other software embeds Brotli.
The versions to install
Node.js released its fixes on October 21, Google’s Brotli library has been fixed too, and Microsoft shipped an emergency .NET update on Sunday, October 25. CERT/AQ adds PowerShell 7 and the PHP builds for Windows.
ℹ️ Good to know for .NET
According to Microsoft, ASP.NET Core and HttpClient do not decompress Brotli in their default configuration. A .NET application is exposed if it has turned that decompression on or calls the Brotli functions directly. Microsoft still recommends installing the update. Afterwards, restart the applications and rebuild container images.
Check in 5 minutes
You don’t need a special tool for a first pass. On each server or PC involved, one command shows the installed version. Write it in the last column of the table.
Where to start
Fix what anyone on the Internet can reach first. The rest follows during the week.
Today
- Update Internet-facing applications (portal, API, in-house site).
- Restart services after updating: otherwise the old code stays in memory.
- Can’t patch right away? Block Brotli-compressed requests at the proxy or firewall, or turn off Brotli decompression.
This week
- Rebuild and redeploy affected Docker images.
- Update PowerShell 7 on admin workstations.
- Check internal tools and automated jobs that download files.
Keep an eye on
- Ask software and equipment vendors whether their product embeds Brotli.
- Follow Linux distribution updates.
- Watch for unexpected application crashes, as the Cyber Centre recommends.
🧭 What about my WordPress site?
The advisories we reviewed only list PHP in its Windows builds. Most WordPress sites run on Linux servers, where PHP is not listed for this flaw. Still, ask your host whether its web server and proxies use a fixed version of Brotli.
PHP had its own critical flaw recently: reread our article on the emergency PHP update if that’s not settled yet.
This kind of flaw is hard to track when nobody knows what runs on each server. Our server management service keeps that inventory up to date and applies the patches, our cybersecurity services review your vendors’ software, and our automated 24/7 monitoring with the on-call technician stepping in flags crashes and unusual behaviour on monitored servers.
Book your free cyber check
Not sure whether your applications use Node.js, .NET or PowerShell, or which version? The free cyber check takes stock of what runs in your business and which patches are overdue.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Canadian Centre for Cyber Security, alert AL26-027 (October 28, 2026)
- CERT/AQ, CERTQC-AVIS-2026-397: critical vulnerability in Google Brotli (October 28, 2026) (in French)
- Node.js, October 2026 Security Releases (October 21, 2026)
- Microsoft, .NET October 2026 Out-of-Band Security Updates (October 25, 2026)
- Microsoft, security advisory CVE-2026-111497 for .NET (GHSA-p3jp-9v83-76w9)
- BleepingComputer, Sergiu Gatlan (October 28, 2026)
Photo: Stanislav Kondratiev, Pexels (Pexels licence).