CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Microsoft .NET

product · product:microsoft-net single-source

Coverage
2
first 2026-10-24 → last 2026-10-26
Latest activity
2026-10-26
Node2Shell: crafted Brotli data runs code in Node.js; update the runtime and the PyPI Brotli packages
Peak priority
notable
2 notable
Targets
technology
sectors: technology
Sources cited
16
7 hosts

Action items (3)

Do-now tasks recorded on the entries about Microsoft .NET, newest first. Check the date before acting on an older one.

  • Update every Node.js 22.x, 24.x and 26.x runtime to 22.23.4, 24.22.1 or 26.12.1, including the Node binary inside container images, which a package inventory misses, and upgrade the PyPI Brotli package to 1.2.1 and brotlicffi to 1.2.1.0 wherever either is installed; move any application on an end-of-life Node.js line to a supported release.
    2026-10-24CVE-2026-111497
  • Update every Envoy proxy that has the Brotli decompressor configured to v1.40.0, v1.39.3, v1.38.6, v1.37.8 or v1.36.12; the advisory names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable.
    2026-10-24CVE-2026-111497
  • Install .NET 8.0.33, 9.0.22 or 10.0.14 (11 Release Candidate 3 for the preview) on every host that runs .NET applications, including Windows hosts already updated on 2026-10-13, which still carry CVE-2026-70197; rebuild and republish self-contained applications and rebuild container images from the updated .NET images, because a runtime update on the host does not change a bundled runtime.
    2026-10-26CVE-2026-111497 +3

Defender insights

What each entry about Microsoft .NET tells a defender to do, newest first.

2026-10-24NOTABLENode2Shell: crafted Brotli data runs code in Node.js; update the runtime and the PyPI Brotli packages

Exposure · detection

2026-10-26NOTABLEMicrosoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw

Exposure · detection

Story timeline

  1. 2026-10-26CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)
    trending-vulnerabilitiesMicrosoft ships out-of-band .NET fixes: hosts updated on 13 October still carry the Windows sockets flaw
  2. 2026-10-24CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)
    trending-vulnerabilitiesNode2Shell: crafted Brotli data runs code in Node.js; update the runtime and the PyPI Brotli packages

Hunting pivots

CVEs
CVE-2026-111497 ×2CVE-2026-102870CVE-2026-114148CVE-2026-70197
Releases covered
Microsoft .NET ×2
Tags
patch-available ×2pre-auth ×2rce ×2vulnerabilities ×2
ATT&CK techniques (3 across 3 tactics)

3 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionExploitation for Client Execution
  • Privilege EscalationExploitation for Privilege Escalation

Initial Access TA0001

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · 2026-10-24/cve-2026-111497-node2shell-brotli-decoder-rce-nodejs-pypi · ATT&CK page ↗

Execution TA0002

T1203Exploitation for Client Execution×1

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-10-26/cve-2026-111497-microsoft-net-oob-update-brotli-sockets-fix · ATT&CK page ↗

Entries about Microsoft .NET (2)

2026-10-24 · view entry permalink →

NOTABLECVE-2026-111497updatedNATOA1

CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)

Node.js shipped security releases on 2026-10-21 for CVE-2026-111497, an out-of-bounds write in the Brotli decoder it bundles: an invalid block switch was reported as a need for more input instead of a format error, so the streaming decoder kept appending input to an eight-byte internal buffer (Node.js project, 2026-10-21). An attacker who can supply Brotli data that an application decompresses with the node:zlib module can corrupt process memory, which can lead to a crash, disclosure of process memory or remote code execution (Node.js project, 2026-10-21). The Google CNA record scores it CVSS 4.0 9.2 with no authentication and no user interaction (ENISA EUVD, 2026-10-23).

Imperva ran code carried in Brotli data against the official Node.js 24.22.0 Linux arm64 image, both through the built-in fetch() consuming a compressed response and through Express 5.0.0 to 5.3.0 and body-parser 2.0.0 to 2.3.0 request-body parsers (raw() and json()); execution took several attempts, and the fixed 24.22.1 rejected the same input (Imperva, 2026-10-22). A bare Node.js HTTP server does not decode an incoming Brotli body on receipt, so the request path needs those parsers (Imperva, 2026-10-22). Fixes are in Node.js 22.23.4, 24.22.1 and 26.12.1, whose release notes list CVE-2026-111497 as a high-severity Brotli fix (Node.js project, 2026-10-21; Node.js project, 2026-10-21; Node.js project, 2026-10-21); end-of-life lines are always affected when a security release occurs (Node.js project, 2026-10-21). No source reports exploitation.

The decoder is Google's, so the flaw reaches beyond Node.js: Google released Brotli 1.2.1 on 2026-10-21 and lists CVE-2026-111497 in its release as an out-of-bounds write that permits remote code execution (Google Brotli, 2026-10-21), and the CVE record covers Brotli 1.0.3 to 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1 (ENISA EUVD, 2026-10-23). OpenSourceMalware found that the PyPI packages Brotli (up to 1.2.0, fixed in 1.2.1 on 2026-10-22) and brotlicffi (up to 1.2.0.2, fixed in 1.2.1.0 on 2026-10-23) compile the same decoder and that neither release's notes mention the flaw (OpenSourceMalware, 2026-10-23); ENISA's record now carries PyPI advisories that cite that post, so the PyPI exposure rests on its source diff (ENISA EUVD, 2026-10-23). Envoy and Microsoft .NET have shipped fixes as well (Envoy, 2026-10-23; .NET Blog, 2026-10-25).

A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.

Node.js project 2026-10-21

Our standalone proof of concept ran code carried in a Brotli response or request body inside applications using the official Node.js 24.22.0 Linux arm64 image.

Imperva Threat Research 2026-10-22

Envoy deployments that have Brotli decompressor configured.

Envoy Proxy (security advisory) 2026-10-23
Updaterun 2026-10-26T0256Z-intelactionsaffected_productsbodycvesentitiesevidencesourcessummary

Two more vendors have shipped fixes for the same decoder flaw. Envoy's advisory of 2026-10-23 says a buffer overflow in its Brotli decompressor allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service or potentially execute arbitrary code with a crafted Brotli-compressed stream; it names v1.39.2, v1.38.5, v1.37.7 and v1.36.11 as vulnerable, v1.40.0, v1.39.3, v1.38.6, v1.37.8 and v1.36.12 as fixed, and limits the impact to deployments that have the Brotli decompressor configured (Envoy, 2026-10-23). Microsoft's out-of-band .NET release of 2026-10-25 (8.0.33, 9.0.22, 10.0.14 and 11 Release Candidate 3) fixes the same CVE, and an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic decompression or the Brotli APIs (dotnet/announcements #494, 2026-10-25); .NET Blog, 2026-10-25 lists the fixed releases. No source reports exploitation outside Imperva's laboratory demonstration against Node.js.

vulnerability24 Oct 03:33Zmulti-sourceOpen finding →
Sources: Node.js project · Node.js project (release v22.23.4) · Node.js project (release v24.22.1) · Node.js project (release v26.12.1) · Google Brotli · ENISA EUVD · Imperva Threat Research · OpenSourceMalware · Envoy Proxy (security advisory) · .NET Blog (Microsoft) · Microsoft (dotnet/announcements, CVE-2026-111497 advisory)

2026-10-26 · view entry permalink →

NOTABLECVE-2026-111497 +3NATOA2

CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)

Microsoft released out-of-band security updates for .NET 8, .NET 9 and .NET 10, with .NET 11 Release Candidate 3, on 2026-10-25 (.NET Blog, 2026-10-25). The fixed runtimes are 8.0.33, 9.0.22 and 10.0.14; .NET Framework is not affected (.NET Blog, 2026-10-25). CVE-2026-111497 is a buffer overflow in the Brotli decoder that .NET uses and may let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service or elevation of privilege (.NET Blog, 2026-10-25); Microsoft scores it CVSS 3.1 8.1 with high attack complexity, marks it publicly disclosed and not exploited, and rates it Exploitation More Likely (MSRC, 2026-10-25). The CVE is the one Node.js fixed on 2026-10-21 (Node.js project, 2026-10-21). Microsoft says an application is exposed only when it decompresses attacker-controlled Brotli data through ASP.NET Core request decompression, HttpClient automatic response decompression that includes Brotli, or the BrotliStream and BrotliDecoder APIs, and that ASP.NET Core and HttpClient do not decompress Brotli by default (dotnet/announcements #494, 2026-10-25).

The release also corrects two fixes of 2026-10-13: Microsoft says that release did not fully address CVE-2026-70197 and CVE-2026-102870 (.NET Blog, 2026-10-25). CVE-2026-70197 is a Windows-only out-of-bounds write: reusing one SocketAsyncEventArgs instance across IPv4 and IPv6 datagram sockets can keep an undersized cached native address buffer, and an unauthenticated attacker can then write out of bounds during ReceiveFromAsync (CVSS 3.1 8.1, high attack complexity) (dotnet/runtime #136445, 2026-10-25); the Security Update Guide rates it not exploited, not publicly disclosed and Exploitation Less Likely, and had said on 2026-10-19 that the vulnerability had not been addressed (MSRC, 2026-10-25). CVE-2026-102870 is code execution in the Blazor WebAssembly debugger when a developer evaluates an expression that involves attacker-controlled application data (CVSS 3.1 8.8, user interaction required); it needs the standalone Server and DevServer package references updated, because updating only the shared runtime is not a substitute (dotnet/announcements #492, 2026-10-25). CVE-2026-114148 is incorrect file ownership in Linux ASP.NET Core runtime and targeting-pack tarballs of .NET 8 and 9 and in source-built tarballs, a local privilege escalation (CVSS 3.1 7.8) (dotnet/announcements #495, 2026-10-25). No source reports exploitation of any of the four.

Today, we are releasing out-of-band (OOB) security updates for .NET 8, .NET 9, and .NET 10, along with .NET 11 Release Candidate 3.

because the October 13, 2026 release did not fully address these issues

.NET Blog (Microsoft) 2026-10-25

ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations.

Microsoft (dotnet/announcements, CVE-2026-111497 advisory) 2026-10-25

Builds on: Node2Shell: crafted Brotli data runs code in Node.js; update the runtime and the PyPI Brotli…

vulnerability26 Oct 03:36Zsingle-sourceOpen finding →
Sources: .NET Blog (Microsoft) · Microsoft (dotnet/announcements, CVE-2026-111497 advisory) · Microsoft (dotnet/runtime, CVE-2026-70197 advisory) · Microsoft (dotnet/announcements, CVE-2026-102870 advisory) · Microsoft (dotnet/announcements, CVE-2026-114148 advisory) · Microsoft Security Response Center (CVE-2026-111497) · Microsoft Security Response Center (CVE-2026-70197) · Node.js project

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns2

Source distribution

  • github.com6 (38%)
  • nodejs.org4 (25%)
  • msrc.microsoft.com2 (12%)
  • devblogs.microsoft.com1 (6%)
  • euvdservices.enisa.europa.eu1 (6%)
  • imperva.com1 (6%)
  • opensourcemalware.com1 (6%)
All cited sources (16)