Admins who installed Microsoft’s Oct. 13 .NET security update have one more to apply. On Sunday, less than two weeks after that regular release, Microsoft shipped an out-of-band round of .NET 8.0.33, 9.0.22 and 10.0.14, plus .NET 11 Release Candidate 3, and Rahul Bhandari, a senior program manager on the .NET team, recommended updating as soon as possible.
Part of the reason is unfinished business. The October update didn’t fully address CVE-2026-70197, a SocketAsyncEventArgs memory corruption bug, or CVE-2026-102870 in the Blazor WebAssembly debugger, so Microsoft re-released both advisories with the new builds carrying the complete fixes. The .NET 10 support note lists the Blazor bug as remote code execution and says this build corrects BrowserDebugHost packaging for that fix. Teams using the affected Blazor WebAssembly packages also need to update their NuGet references, because a runtime update leaves those alone.
The bigger fix covers CVE-2026-111497, the out-of-bounds write in Google’s Brotli decoder that Node.js disclosed last Wednesday and that has since sent maintainers of Bun, Envoy, Istio and Python’s Brotli packages to their own patches, as WebProNews reported Saturday. Microsoft’s Security Update Guide entry scores it 8.1 under CVSS 3.1 and marks exploitation as more likely, while listing the flaw as publicly disclosed but not exploited.
Who has to act on the Brotli bug
Many .NET apps won’t be exposed. ASP.NET Core request decompression and HttpClient automatic response decompression are both off by default, and .NET Framework isn’t affected. “An application is not exposed merely because an affected .NET package is installed,” Microsoft wrote in its GitHub security advisory. The risk falls on apps that switched on Brotli decompression for either feature, or that call BrotliStream or BrotliDecoder on data an attacker controls.
Where that applies, a new runtime on the host may not be enough. Self-contained apps and containers carry their own runtime and must be rebuilt and redeployed, and a decoder already linked into a NativeAOT executable stays there until the app is republished with patched SDK and runtime-pack versions. Until then, Microsoft suggests removing the “br” entry from existing decompression settings. It also cautions developers against adding decompression code they weren’t already using, since that can bring denial-of-service risks of its own.
JFrog researchers crashed the .NET runtime with a crafted two-stage Brotli stream in a local console app, and they noted in their write-up that the native fault kills the whole process instead of raising a managed exception. The dotnet/runtime issue tracking the bug remains open, JFrog said, so the fixes can be ported to the project’s public GitHub branches.