Latest / The Digital Warfare Podcast / EP. 189: CVE-2026-111497: Brotli Buffer Overflow Forces Emergency Patches Across Node.js and .NET
Transcript
- riverside 6adf9921ecca06eb318d3839 0 final padding digital warfare's s: One malformed compressed stream can turn a routine decompression operation into memory corruption inside some of the world's most widely deployed application platforms. And now the blast radius is getting bigger. Welcome to the Digital Warfare Daily Brief. Today we are tracking CVE-2026-111497, a critical out-of-bounds right vulnerability in the Brotley decoder. The floor first drew major attention through Node.js. Now, Microsoft has released emergency out-of-band security updates for.NET 8,.NET 9, .NET 10, and.NET 11 release candidate 3. That changes the story. This is no longer just a node.js problem. This is a shared component problem. Brotly is a lossless compression technology used across web traffic, application runtimes. Browsers, servers, libraries, and cloud infrastructure. And when vulnerable software decompresses attacker-controlled brotly data, the decoder can write beyond the boundary of an internal memory buffer. That means memory corruption, potential information disclosure, application crashes, and, depending on the affected process and memory layout, potentially arbitrary code execution. Here is the technical failure. The Brotley decoder can be manipulated with a specially crafted compressed stream. During block type processing, the decoder can enter an invalid internal state. Instead of rejecting that malformed input cleanly, vulnerable implementations can continue processing. Data then gets written past the intended buffer boundary. Once an attacker starts corrupting process memory, the security problem is no longer just malformed compression. The attacker is interfering with the application's execution environment. That is where denial of service, memory disclosure, privilege escalation, or code execution can enter the picture. For Node.js, the affected supported branches include 22.x, 24.x, and 26.x. For.NET, Microsoft has now released patched runtimes including 8.0.33, 9.0.22, And 10.0.14. And there is an important point for defenders. Having a vulnerable Brotly library installed does not automatically mean the application is exploitable. The application must actually process attacker-controlled Brotly data. In.NET, that can happen when an application explicitly enables Brotly request decompression, enables Brotly response decompression in HTTP client. Or directly uses Brotley decompression APIs. ASP.NET Core does not enable brotly request decompression by default. HTTP client does not automatically decompress Brotly responses by default either. That matters. Security teams need to identify real exposure, not simply count packages. But do not use that nuance as an excuse to delay patching. Because the vulnerability exists in a component that sits underneath applications. Developers may not even realize Brotly is present until an advisory forces them to look. There is another complication. Some self-contained and native AOT.NET applications carry runtime components inside the application itself. Updating the shared runtime on the operating system may not fix those binaries. They may need to be rebuilt and redeployed. Here are today's defensive orders. Find where Brotly is actually being used. Check node.js runtimes. Check.NET applications. Check containers. Check self-contained builds. Check native AOT deployments. Check web servers, proxies, and services that accept compressed input. Then patch. For.NET, install the updated runtime or SDK. For node.js. Move to the fixed supported releases. Then restart or redeploy the affected applications. And if immediate patching is impossible, stop vulnerable services from decompressing untrusted Brotly data until remediation is complete. At this time, there is no confirmed widespread exploitation in the wild. Keep that distinction clear. But the absence of confirmed attacks does not remove the risk. The vulnerable component is widespread. The attack surface is network reachable in exposed configurations, and patches are already moving across multiple ecosystems. That is enough reason to act. CVE-2026-111497 delivers a simple lesson. Your application can be secure at the business logic layer and still be compromised by code buried underneath it. Patch the runtime, map the decompression path. And do not let untrusted compressed data reach vulnerable memory handling code. This has been the Digital Warfare Daily Brief. Stay secure and stay ahead.