Azure Functions Brotli Patch Still Rolling Out: Check Your Running .NET Apps Now

On October 26, Microsoft said it is still rolling out the .NET fixes for the Brotli vulnerability across Azure Functions. Administrators should not assume that every app instance is already protected. Earlier warnings about Node2Shell did not cover two points that are new here: where the managed Azure platform update stands, and what app owners must do themselves.

What Microsoft’s Update Changes

The fixes cover several issues, including CVE-2026-111497 in the Brotli decoder. Microsoft released patched .NET runtimes on October 25 and described the Azure Functions rollout the next day. For functions running on Linux, the rollout was still in progress. For functions on Windows, protection depends on updates to the App Service environments.

Independent industry reports confirm that Microsoft released emergency patches. The Azure notice also explains why a patched .NET release does not mean every cloud service has already been updated.

Which Apps Need Checking

Three factors matter: the operating system, the Functions hosting plan, and how the app is deployed. Microsoft makes a clear distinction between updates the platform manages and runtimes that ship with the app or run in custom container images.

To exploit the vulnerability, an attacker has to get the app to process specially crafted Brotli-compressed data. Automatic decompression of requests and responses is not on by default. Check whether your app and its dependencies actually use this feature instead of assuming every HTTP function is equally exposed.

What to Do Now

• Identify the Azure Functions plan, operating system and execution model of each app.
• Check the .NET version in the running process. The installed SDK version does not tell you which runtime the app actually uses.
• For deployments that bundle their own runtime, rebuild and republish the app with the patched components.
• Rebuild and redeploy custom container images.
• After updating, verify active instances and test the decompression paths your app uses.

SecurHUB’s Take

With managed services, it pays to assign clear responsibility for the platform, the application dependencies and the container images. A cloud security audit can help confirm that a reported update also covers the code actually running in production.

Sources: Microsoft Azure, SecurityWeek