decrypted · 26 october 2026 · ransomware and cybercrime · vulnerabilities and patching

Node2Shell reaches .NET: Microsoft's emergency Brotli patches

Node2Shell, the Node.js flaw we covered on Sunday, now reaches beyond one runtime. Today Microsoft released emergency out-of-band updates for the same identifier, CVE-2026-111497, in .NET, the framework behind many UK line-of-business applications. Imperva's Red Team found the flaw, and proof-of-concept code is public. BleepingComputer reports no malicious exploitation in the wild yet, which is precisely when to act.

What actually broke

Brotli is a compression format that shrinks web traffic. Think of a vacuum-packed parcel: the sender seals it flat, and the receiver's software unpacks it into a box sized in advance. The decoder has to trust the packing instructions. In Imperva's analysis of the Node.js copy, the decoder met an instruction the stream's structure made impossible, treated it as a request for more data, and carried on in a broken internal state. It then wrote past the end of its box, which Imperva says can permit remote code execution. Microsoft calls its flaw a buffer overflow in .NET's Brotli decompression, which an unauthenticated attacker may use to read or corrupt memory.

Who is exposed

Fewer than you might fear, but more than you will guess. Microsoft says request and automatic response decompression are off by default, and .NET Framework is not affected. You are at risk if an application uses ASP.NET Core request decompression, HttpClient automatic response decompression or the Brotli compression APIs, the ways programs call it. Fixed releases are 8.0.33, 9.0.22 and 10.0.14, with .NET 11 users moving to Release Candidate 3. For Node.js, Imperva lists 22.23.4, 24.22.1 and 26.12.1, and notes that Express and body-parser can route untrusted request bodies into the decoder, as can the built-in fetch when it reads a compressed response. Imperva also says its exploit did not work on every attempt.

What defenders must check

Patching the server does not patch the application. Microsoft says self-contained apps must be rebuilt and republished, because a newer host runtime does not update the one bundled inside them, and containers need rebuilding from updated images. Imperva warns that package inventories can miss bundled runtimes, so check what is actually deployed. If you cannot patch today, block incoming Brotli-compressed requests at a proxy or firewall, or disable Brotli decoding until you can.

The Secure by Design lesson

The default saved people: decompression ships switched off, so many UK estates are exposed only if someone once enabled it for speed. Code that decodes untrusted input is among the riskiest in any application, so it should stay off until a person chooses otherwise, and ideally be written in a memory-safe language.

The cost of the fix is an inventory, not a patch. If you cannot say which runtimes sit inside which apps and containers, a director's question like "are we exposed?" takes days to answer, and attackers need less time than that. Ask your suppliers for that list this week, in writing.

Also this week

Quest Diagnostics takes its lab portal offline. One of the largest clinical laboratory companies in the United States stopped its Quanum Lab Services Manager, the system clinicians use to place test orders and look up results, after unauthorised access came to light this week. Quest says it believes some patient data was involved, has told law enforcement and has filed a notice with the SEC. As of Friday no group had claimed responsibility, and Quest said the incident was unrelated to the recent PHP flaws. The reporting does not mention UK patients, so this is a pattern rather than a UK incident. A single portal sat between clinicians and results, and the fallback was paper requisitions. Quest's 2019 breach at a billing collector, which exposed about 11.9 million of its patients, is the reminder that suppliers' suppliers count. UK health suppliers and their customers should ask what their own fallback is, who invokes it, and how long it can carry the load.

Guessable serial numbers expose Dahua cameras. Ukraine's national emergency response team, CERT-UA, warned that attackers are reaching internet-connected Dahua cameras and recorders, changing settings and creating unauthorised user accounts, according to The Record. The route is Easy4IP, a cloud remote-access feature that connects devices by serial number. Those numbers follow predictable patterns, so cameras can be found even if the numbers were never published. Attackers then try weak or default passwords, or firmware flaws that bypass authentication, including CVE-2021-33044 and CVE-2021-33045 from 2021. CERT-UA did not say how many devices were hit or who was behind it. The Secure by Design reading is plain: a camera is a networked computer, and remote access that can be found by guessing should be off unless someone asked for it. Check your estate for it, and change the defaults.

Sources

Want a second pair of eyes on which runtimes sit inside your applications? get in touch.