Microsoft launched an emergency out-of-band update on Sunday to fix a high-severity security hole in its .NET platform, triggered by growing warnings from researchers about potential attacks. Known as Node2Shell, the bug impacts Brotli, a widely used web compression library.

Carrying the identifier CVE-2026-111497, the vulnerability received a severity rating of 9.2 out of 10. OpenAI's Codex Security team uncovered the issue during red-teaming tests, with researchers Khai Tran and Sylvie Mayer bringing it to the attention of Node.js. The Node.js group tracked the root cause to the C decoder in Brotli, where an invalid block switch improperly triggered requests for additional input rather than signaling a format error.

CVE-2026-111497 involves a buffer overflow in how .NET uses the Brotli decompression algorithm, potentially permitting an unauthenticated malicious actor to read or corrupt process memory, which can cause information disclosure, denial of service, or privilege escalation across all platforms. A second issue, CVE-2026-114148, involves unsafe ownership metadata in impacted .NET tarballs on Linux, which could let a local attacker alter files and secure higher privileges.

Brotli versions 1.0.3 through 1.2.0 contain the vulnerability, while corrected updates became available in versions 1.0.10, 1.1.1, and 1.2.1 last week. The flaw enables unauthenticated hackers to read or compromise process memory, leading to information leakage, service disruption, or privilege escalation.

The urgent Microsoft fix applies to .NET versions 8, 9, 10, and .NET 11 Release Candidate 3, along with impacted builds of Visual Studio and PowerShell. The legacy .NET Framework remains untouched because .NET does not activate Brotli decompression by default.

The impact stretches far past Microsoft products. Bun, Envoy, Istio, and Python Brotli packages released their own patches, while JFrog experts discovered the same security gap in FFmpeg, ClickHouse, and Apache Arrow. Google and Node.js delivered corrected builds on October 21.

According to cloud security company Wiz, 91 percent of cloud environments hold vulnerable assets, and 82 percent feature publicly exposed Node.js instances. At this stage, no threat actor has deployed the flaw in an active exploit.

Pakistani developers using .NET, Node.js, or other impacted libraries need to apply patches right away. Containerized service teams must also rebuild their images since running processes retain the outdated code, while cloud-hosted apps on platforms such as Azure require the update for protection.