TL;DR

what: CVE-2026-111497 is an out-of-bounds write in Google's Brotli C decoder, versions 1.0.3 to 1.2.0, triggered by crafted Brotli-compressed data.

impact: Any program that decodes attacker-controlled Brotli can crash, leak memory or run attacker code, and Imperva has demonstrated remote code execution on unpatched Node.js 24.22.0.

fix: Fixed in Brotli 1.0.10, 1.1.1 and 1.2.1, Node.js 22.23.4, 24.22.1 and 26.12.1, Bun 1.4.4, Envoy 1.40.0 and backports, Istio 1.31.2, 1.30.6 and 1.29.9, Python Brotli 1.2.1, brotlicffi 1.2.1.0, and cdxgen 13.5.0 and 12.8.9.

who: Teams running Node.js or Bun services that fetch remote content or accept compressed uploads, Envoy or Istio meshes with Brotli decompression enabled, and any Python application with Brotli or brotlicffi installed.

A memory-corruption flaw in Google's Brotli decompression code, tracked as CVE-2026-111497, gives attackers a way to write past the end of a buffer in any program that decodes Brotli data they control.…