Key points
- Microsoft and the PHP project have released fixes for the Google Brotli decoder flaw, CVE-2026-111497, after Node.js patched it last week.
- Microsoft rates the bug 8.1 out of 10 in .NET and has issued out-of-band updates for versions 8, 9, 10 and the 11 release candidate.
- Red Hat has no fixed packages yet for Enterprise Linux 7 to 10 and advises stripping or rejecting Brotli-encoded traffic from untrusted clients.
Microsoft and the PHP project have released fixes for the Google Brotli decoder flaw that Node.js patched last week, following industry realisation around how widespread the vulnerability is.
The danger level posed by the flaw remains disputed, however, as the attack complexity is rated as high and requires a precisely crafted data stream.
Microsoft rates exploitation as more likely, while Red Hat said public proof-of-concept code causes crashes but no reliable remote code execution exploit has been seen.
Researchers at JFrog have also shown an attack through the FFmpeg media framework using a crafted image file, which takes the flaw beyond web traffic.
Microsoft rates the flaw as 8.1 out of 10 in .NET, and has released out-of-band updates for versions 8, 9 and 10 and the 11 release candidate of the coding framework.
“We recommend updating as soon as possible,” Rahul Bhandari, senior program manager at Microsoft, said.
The fixed .NET runtimes are 8.0.33, 9.0.22 and 10.0.14, and PowerShell and Visual Studio have also been patched.
Exposure is narrower than in Node.js, as ASP.NET Core and HttpClient do not decompress Brotli data by default.
Self-contained and NativeAOT applications carry their own copy of the runtime, so they must be rebuilt and redeployed rather than simply updated on the server.
Meanwhile, PHP has released rebuilt Windows packages, 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, which bundle the fixed Brotli library.
On Windows, attackers can reach the decoder through the cURL extension when automatic response decompression is turned on, which it is not by default.
For Linux, PHP uses different distributions’ Brotli libraries, and patching is underway across the open-source platforms.
As of writing, Debian, Alpine, Ubuntu and openSUSE Tumbleweed have shipped fixed packages
Red Hat lists its Enterprise Linux 7 to 10 as affected and has no fixed packages yet.
In the meantime, it advises administrators to strip or reject Brotli-encoded traffic from untrusted clients at reverse proxies and load balancers.
Apple has not said whether macOS is affected.
The bug, CVE-2026-111497, is an out-of-bounds write in Brotli versions 1.0.3 to 1.2.0, and Google has fixed it in 1.0.10, 1.1.1 and 1.2.1.
Many products carry their own copy of the decoder, meaning each needs its own update.
