CVE-2026-111497 in Brotli: fix in version 1.2.1 and affected dependencies in Node.js, Envoy and PyPI packages

What happened and what to do

On 24 October 2026, Alan Coopersmith posted an advisory on the oss-sec list about CVE-2026-111497, which affects Brotli, a widely used compression library. The project released Brotli 1.2.1 with the fix. According to Patch the Planet, releases of Node.js, Bun, Envoy Proxy and Istio already incorporate the correction, and other software should be checked. Aikido added the brotli packages published on PyPI to the list, among others.

In practice, a company can start with a dependency inventory: which applications, container images, proxies and build pipelines include Brotli, directly or transitively, across the npm and PyPI ecosystems. With that map, it is possible to compare production versions with the fixed releases and prioritize updates for internet-facing services. It is also worth automating continuous checks with dependency analysis tools integrated into CI and alerts for new advisories, and keeping an up-to-date SBOM for audits. After updating, regression tests and runtime validation confirm the fix is active.

How the consultancy can help

Assessment of your exposure to CVE-2026-111497 across your software estate, with an inventory of Brotli dependencies in applications, containers and proxies. Then a prioritized update plan, continuous checks implemented in CI, and operation of alerts for future advisories.

Next step

Send a short description of your environment, such as stack, exposed services and build tools, and receive a scoped proposal for the assessment and remediation.