← All resources

Brotli flaw: Node.js patched, then .NET out-of-band (25/10/2026)

Published October 27, 2026 · 7 min read · CyberNovaLabs.io

One Brotli flaw triggered two separate fixes in four days, first at Node.js, then at Microsoft. The defect belongs to neither: it comes from a Google library that both of them bundle. For an SME, the useful question is not "do we run Node.js?" but "what is inside the software we run, and who updates it?".

The short version

On 21 October 2026 the Node.js project shipped a security release fixing 11 CVEs, four of them rated high severity^[1]. One is the Brotli flaw CVE-2026-111497: malformed compressed input writes past the end of an eight-byte internal decoder buffer, which can cause a crash, disclosure of process memory, or remote code execution^[1]. On 25 October, Microsoft shipped an out-of-band .NET update for the same CVE^[2]. The defect sits in neither Node.js nor .NET: it is in the Google Brotli decoder that both of them bundle.

What happened, in order

Four dates, four parties, one bug. This is the timeline to have in hand before you call your IT provider.

As of 26 October, Rapid7 was not aware of exploitation in the wild, and the CVE was not listed in CISA's Known Exploited Vulnerabilities catalog^[4]. That is a quiet window, not a pass: in the same weeks, the critical PHP flaws went from disclosure to mass exploitation in a matter of days.

Why one bug produced three advisories that look unrelated

Look at the headlines. CERT-FR filed it under "Node"^[3]. Microsoft published it under ".NET"^[2]. The Dutch NCSC wrote about the "Google Brotli decoder"^[5]. Three entries, three vocabularies, one defect.

The consequence is very practical. If your monitoring consists of watching your vendor's name, you saw one advisory out of three. And if your provider answered "we don't do Node.js here", they answered a different question: this was about a library, not a language. The affected upstream Brotli versions are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1^[4] — that is the number to search for in an inventory, not the product name.

It is the same mechanism we saw with your IT provider's remote access tooling: the component that exposes you is almost never the one you bought.

Are you actually exposed? The test is specific

Here, Rapid7's analysis is more useful than the general alarm. The presence of an affected decoder does not by itself establish exposure: the application has to actually decompress Brotli data supplied by an untrusted party^[4]. Plenty of systems bundle the library and never process compressed input from outside.

Three questions settle it, and they are for whoever wrote or maintains your application:

1. Does our application decompress Brotli sent by a user, a customer, or a third-party interface? If the answer is a demonstrated no, the urgency drops a level.
2. Which exact versions of Node.js and .NET are running in production today? Not the version in the repository — the one on the server that answers requests.
3. Which other services accept compressed input? A file upload form, a public API, a webhook: these are what turn a vulnerable library into real exposure.

An honest answer to those three beats a green dashboard. And a missing answer is itself the finding: it means nobody is keeping the inventory.

"Patched" is a version number, not a date

The most instructive detail of the week is buried in Microsoft's 25 October update. It contains two re-released fixes, CVE-2026-70197 and CVE-2026-102870, because the 13 October release had not fully resolved them^[2].

In other words, "we applied the October updates" proves nothing. An estate can have taken the 13 October patch, report itself up to date, and still be exposed on two defects out of four. The only statement worth anything is a version number compared against the vendor's list. Ask for it in writing, with the date it was measured.

If it becomes an incident, your contact depends on the country

CyberNovaLabs.io works in the Netherlands, Belgium, France and Luxembourg, and that is exactly where this gets complicated. Remote code execution on an application server stops being a technical topic and becomes a reporting one.

• Belgium: the Centre for Cybersecurity Belgium (CCB) is the national authority and point of contact for entities in scope of the NIS2 law.
• Netherlands: the NCSC, which issued its call to patch on 23 October^[5], with the RDI supervising under the Cyberbeveiligingswet.
• France: ANSSI, whose CERT-FR issued the 22 October advisory^[3].
• Luxembourg: the ILR as supervisory authority, with CIRCL as the response team.

Deadlines and scope depend on your entity status, and that status is not something to guess: have it confirmed before you need it. If you build software or work inside client systems, our guide to NIS2 for software vendors and IT providers in the Netherlands covers the scoping question. We do not give legal advice: the national text and your own authority remain the reference.

At CyberNovaLabs.io

This week illustrates an ordinary SME weakness: nobody can say, in under a minute, what is inside the software that runs the business. We build and maintain custom business applications with the component inventory and the update procedure written down from day one — see our custom software development page. If you are an IT provider or MSP who has to carry this conversation to your own clients, we also fill sales calendars on exactly this ground: see B2B appointment setting in Amsterdam. To talk it through with no commitment, send us two lines: you will get precise questions back, not a generic quote.

Sources

1. Node.js — Wednesday, October 21, 2026 Security Releases (projet Node.js, 21/10/2026)
2. .NET October 2026 out-of-band security updates (Microsoft, dotnet/announcements #496, 25/10/2026)
3. CERTFR-2026-AVI-1367 — Multiples vulnérabilités dans Node (CERT-FR / ANSSI, 22/10/2026)
4. CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder (Rapid7, 26/10/2026)
5. NCSC adviseert om lek in Google Brotli-decoder meteen te patchen (Security.NL, 23/10/2026)

Read next