Security Advisory: .NET Brotli Security Vulnerability (Updated November 2, 2026)

  • Updated

 

Executive Summary

Optimizely has actively addressed a security vulnerability disclosed by Microsoft in the .NET Brotli decoder (CVE-2026-111497), which Microsoft resolved in out-of-band security releases (including .NET 10.0.14 and .NET 8.0.33) on October 25, 2026. Following the disclosure, Optimizely Engineering and Security teams initiated a review of Optimizely Content Management System (CMS), Commerce Connect, and their supporting hosting infrastructure. The Optimizely DXP build pipeline is already producing container images on the patched .NET runtime; however, CMS and Commerce Connect customers on DXP whose environments were last deployed before the patched images became available must redeploy to receive the fix. Self hosted customers must update their deployments accordingly.

There is no evidence of exploitation across any Optimizely product or customer environment.

 

What Happened

On October 25, 2026, Microsoft released security updates for .NET 10.0.14 and .NET 8.0.33. Applications are affected if they use Brotli decompression through any of the following:

  • ASP.NET Core request decompression
  • HttpClient automatic response decompression
  • The System.IO.Compression Brotli APIs

 

What We Are Doing

Optimizely Engineering began review of CMS, Commerce Connect, and supporting DXP infrastructure on October 28, 2026, at 07:39 UTC.

  • The DXP build pipeline uses Microsoft's official ASP.NET Core runtime image, tagged by .NET major version (for example, 10.0 or 8.0) to match the version your application targets. Every new container build automatically pulls the latest patched runtime available at the time of deployment.
  • Microsoft updated the default .NET 10.0 image to version 10.0.14 on October 26, 2026. All DXP container builds since that date include the fix.

Important Action for CMS & Commerce Connect Customers Hosted on DXP

For customers hosted on Optimizely DXP, our build pipeline automatically pulls the latest available patched .NET runtime (for your application's target .NET version) whenever a container image is built. Environments that have not been redeployed since the patched images were published continue to run the previous runtime.

  • Who is impacted: CMS and Commerce Connect customers on DXP whose most recent deployment occurred before October 26, 2026.
  • Required Action: You must trigger a container image rebuild by deploying a code package with a new name or version number. This package can contain the exact same code currently running in production, but it must be uploaded as a new code package not previously deployed on DXP to force a fresh container build and apply the patched .NET runtime. Promote the package through your normal release workflow so the rebuilt image reaches Production.
  • CMS 13 and Commerce Connect 15 (.NET 10): New builds will use .NET 10.0.14 or later.
  • CMS 12 and Commerce Connect 14 (.NET 8): New builds will use the latest .NET 8.0 servicing release available at the time of deployment, which includes the fix (.NET 8.0.33 or later). .NET 8 reaches end of support on November 10, 2026, so we strongly recommend planning your move to CMS 13 and Commerce Connect 15 (see note below).
  • Note on .NET 8 end of support: Microsoft will end support for .NET 8 on November 10, 2026. After that date, Microsoft will not release further security fixes for .NET 8, including for newly discovered vulnerabilities. CMS 12 and Commerce Connect 14 run on .NET 8, so customers should plan to upgrade to CMS 13 and Commerce Connect 15, which run on .NET 10 (Long Term Support, supported through November 2028), as soon as possible.

Important Action for Self-Hosted CMS & Commerce Connect Customers

  • Who is impacted: Customers hosting CMS or Commerce Connect on their own infrastructure outside of Optimizely DXP.
  • Required Action: Update the .NET runtime (or your ASP.NET Core container base image) to 8.0.33 or later (CMS 12 / Commerce Connect 14) or 10.0.14 or later (CMS 13 / Commerce Connect 15), then rebuild and redeploy your application.
  • Official image availability (UTC): Microsoft published updated mcr.microsoft.com/dotnet/aspnet:10.0 images on the following dates: Alpine and chiseled – October 25; Ubuntu Noble (default 10.0 tag) – October 26; Nano Server – October 27; Azure Linux 3.0 – October 29.

 

How to Contact Us

If you have any questions regarding this advisory or need assistance with redeploying your environment, please reach out to your Customer Success Manager (CSM) or contact Optimizely Support at support@optimizely.com.