Security & Compliance
October 26, 2026Brotli2Shell hits Node.js and .NET: your Azure patch plan
CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder that Node.js says permits remote code execution, and it reaches Node.js 22, 24 and 26, .NET 8, 9 and 10, and the PyPI Brotli package. Fixes landed on 21, 22 and 25 October 2026, Imperva has a working exploit on Node 24.22.0, Node 20 will never be patched, and this guide covers who patches what in Azure, which code paths decode untrusted Brotli, and a seven-step audit.
Brotli2Shell
Node2Shell
CVE-2026-111497
Node.js
.NET
Azure App Service
Azure Functions
Azure Container Apps
Azure Front Door
Next.js
NIS2
Cyber Resilience Act
By Falak Mahmood