Reported News
Brotli fixes have to reach the decoder that runs
CVE-2026-111497 crosses libraries, runtimes and managed deployments. Verify the decoder in the actual workload.
CVE-2026-111497
Out-of-bounds write in the Brotli decoder
A flaw in the reference Brotli C decoder lets a crafted compressed stream write beyond an internal buffer during streaming decompression.
FISRO coverage
Read the relevant deployment conditions, remediation steps and limits of the evidence in the linked material.
Sources from this coverage
- google/brotli release v1.2.1Brotli maintainers (Google)
- Wednesday, October 21, 2026 Security ReleasesNode.js project
- Brotli native decoder: CVE-2026-111497AWS Security
- GHSA-9v8h-qqgm-4m35: Out-of-bounds write in the Brotli decoderGitHub Advisory Database
- CVE-2026-111497Debian Security Tracker