.NET Blog (Microsoft)
dotnet-blog · A · candidate
https://devblogs.microsoft.com/dotnet/
Added 2026-10-26 (S1): first-party channel for .NET servicing and out-of-band security releases; its 2026-10-25 post announced the Brotli fix and the incomplete-fix re-releases, and no slice feed had surfaced it. The feed reads direct (five items, newest 2026-10-25T18:45Z). Candidate: promote to active after 3 contributing runs. | 2026-10-26: content_scope general-news, because the blog carries mostly non-security .NET posts and only the servicing posts are security relevant.
Cited in 2 entries
Citation cadence
Citation days per ISO week (2 weeks of coverage span, total 2).
- CVE-2026-111497 / CVE-2026-70197, Microsoft .NET: an out-of-band release fixes a Brotli decoder flaw and delivers the Windows sockets fix that the 13 October update did not contain, in 8.0.33, 9.0.22 and 10.0.14 (CVSS 3.1 8.1)2026-10-26
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24