Microsoft Issues Emergency .NET Patches for Critical Brotli Compression Flaw

Microsoft released emergency .NET security updates to address a critical vulnerability in the Brotli compression library integrated within the .NET framework. The vulnerability is tracked under multiple names—Broccoli2Shell, Node2Shell, and HTTP2Shell—reflecting its potential impact across different components of the framework. According to reports, the flaw could be exploited through crafted HTTP/2 requests to trigger remote code execution or denial of service conditions. The company has not disclosed a CVE identifier in the initial advisory, but has rated the issue as critical. Emergency patches have been released through normal update channels, and Microsoft recommends that organizations apply the updates as soon as possible to mitigate the risk. The simultaneous use of multiple tracking names suggests this is a newly disclosed or widely tracked issue affecting the Brotli compression component. Independent verification of active exploitation in the wild is pending, but the severity rating and emergency nature of the update indicate significant risk.