Update Oct 26: PHP rebuilt its official Windows packages (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1) with fixed Brotli 1.2.1. The bug is reachable through cURL's automatic response decompression, which is off by default but which apps and HTTP clients can turn on (The Hacker News notes Guzzle's cURL handler does). php -v doesn't change, so check for the -1 build and the hash on the downloads page. Rapid7 (Oct 26) lists the fixed Node.js lines as 22.23.4, 24.22.1 and 26.12.1 and says it knows of no in-the-wild exploitation; the flaw isn't in CISA KEV.

The Brotli decoder out-of-bounds write behind Node2Shell is in every program that bundles its own copy of Google's decoder, and fixes are arriving product by product.

• .NET (Oct 25, out-of-band): fixed in 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3 (CVSS 3.1 8.1). Microsoft says an unauthenticated attacker could read or corrupt process memory. Apps are exposed only if they turn on Brotli in ASP.NET Core request decompression, add DecompressionMethods.Brotli/All to HttpClient automatic decompression, or pass untrusted data to BrotliStream/BrotliDecoder. .NET Framework isn't affected. Self-contained and NativeAOT apps and container images must be rebuilt. Microsoft warns not to add decompression settings as a "mitigation" if you don't already use them. The same release fixes CVE-2026-114148 (Linux source-build tarball ownership).
• FFmpeg: JFrog reached the bug through libjxl, which Brotli-decodes metadata (brob boxes) inside JPEG XL images, and got instruction-pointer control with a crafted file. That is a file-based path, so edge rules blocking Content-Encoding: br don't cover it. The fix is a patched Brotli/libjxl build.
• ClickHouse: one crafted ~23 MB br request body crashed the server. The fix (PR #127419) was merged, with a backport to 26.9 on Oct 26, but no patched release had shipped when JFrog published.
• Apache Arrow: the C++ build bundles Brotli 1.0.9. In pyarrow, a 534-byte input caused an endless CPU loop. No fix was linked yet. Builds that link a patched system Brotli aren't affected.

Do: inventory software that decodes Brotli from untrusted sources, including media pipelines, Parquet/Arrow readers and databases, not just HTTP stacks. Update .NET runtimes and rebuild images. JFrog released an open-source scanner for Brotli decoding paths that version-only scanners miss. Earlier coverage: Node2Shell.