grep -rl "brotli" ./articles
CVE-2026-111497 is a 9.8 in the compression library inside every browser. The commit that fixes it was pushed to public master on 27 February and no release carried it for 236 days.
CVE-2026-111497 was added on 27 October with a due date of 10 November. The catalogue lists Google Brotli, and the fix arrives separately in Node, .NET, Bun, Envoy, Istio, the PHP Windows builds and your distribution's own package.
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, scored 9.2 by Google and High by Node. The exposure most people have is fetch, which decodes Brotli on the response's say-so.