Brotli decoder flaw expands beyond Node.js to Python HTTP clients
CVE-2026-111497 is a Critical out-of-bounds write affecting Google Brotli 1.0.3 through 1.2.0 across all platforms. Python projects may be exposed through automatically loaded Brotli packages, with fixes available in Brotli 1.2.1 and brotlicffi 1.2.1.0.
Why it mattersProduct builders should audit direct and transitive Brotli dependencies, upgrade affected packages, then rebuild and redeploy containers and services.