CVE-2026-111497 — Brotli decoder flaw has demonstrated Node.js code execution and affects multiple software stacks

70/100

Researchers demonstrated code execution using crafted Brotli data on the official Node.js 24.22.0 Linux arm64 image. Affected software also includes Bun, Python Brotli and brotlicffi packages, and Envoy proxies configured for Brotli decompression; update affected libraries and bundled components.