Brotli patches are a deployment problem, not a package update
CVE-2026-111497 reaches bundled decoders, proxies and container images. Updating Brotli alone can leave Node.js and Envoy workloads exposed.
Vulnerabilities, active exploitation, nation-state operations, cryptography and supply-chain compromise. Coverage carries the technical detail defenders need: what's affected, what the fix is, whether it's being used in the wild.
We don't run vendor threat marketing dressed as research, and we don't publish exploitation detail that helps only attackers.
CVE-2026-111497 reaches bundled decoders, proxies and container images. Updating Brotli alone can leave Node.js and Envoy workloads exposed.