Microsoft released out-of-band .NET security updates on Sunday for CVE-2026-111497, a memory-corruption bug in Google’s widely reused Brotli decompression library, and Cloudflare added emergency firewall rules that log, but do not block, matching requests.
An out-of-bounds write in Google’s Brotli decoder, first disclosed in Node.js’s 21 October security release, is turning out to reach well beyond Node.js. Google’s CVE record rates it 9.2, critical; Microsoft rates it 8.1, high. On Sunday Microsoft released out-of-band security updates for .NET 8, 9 and 10 (8.0.33, 9.0.22 and 10.0.14) and .NET 11 RC3, noting that request and automatic response decompression are off by default and .NET Framework is not affected. Cloudflare added two emergency rules for the flaw to its managed firewall ruleset, set to log matching requests rather than block them. JFrog researchers said they reached the decoder through FFmpeg’s JPEG XL handling and the .NET runtime, and crashed a ClickHouse server with one crafted request; Wiz lists affected versions of Bun, Envoy Proxy, Istio and a widely used Go port. No exploitation in the wild has been reported. Fixed upstream versions are Brotli 1.0.10, 1.1.1 and 1.2.1; Node.js users need 22.23.4, 24.22.1 or 26.12.1.
Sources: Microsoft .NET Blog · dotnet/announcements #494 · Cloudflare changelog · Wiz · JFrog Security Research · Node.js · NVD