https://seclists.org/oss-sec/2026/q4/373: Brotli CVE-2026-111497

Q: Is this limited to Node.js deployments?

No. The underlying issue is in Google Brotli and can affect any software that consumes it. The advisory specifically identifies downstream consumers including Envoy, Bun, Istio, and PyPI Brotli packages.

Q: What component should be updated if the affected application uses Google Brotli directly?

Google Brotli version 1.2.1 has been published for the library itself. Downstream applications need releases that incorporate the corrected library version.

Q: How can I identify potentially affected software in my environment?

Inventory software that directly or transitively uses Google Brotli, rather than limiting review to Node.js. The provided information specifically calls out Node.js 26.x, 24.x, and 22.x, as well as Bun, Envoy Proxy, Istio, and PyPI Brotli packages.

Q: What should be done when an immediate application upgrade is not available?

The provided information does not describe a workaround or configuration-based mitigation. Review the application's dependency chain for Google Brotli and obtain a vendor release incorporating Brotli 1.2.1 when available.

Published Oct 24, 2026

Updated

Affected Software

2 affected components

Node.js Node.js

Google Brotli<1.2.1

Frequently Asked Questions

Is this limited to Node.js deployments?

No. The underlying issue is in Google Brotli and can affect any software that consumes it. The advisory specifically identifies downstream consumers including Envoy, Bun, Istio, and PyPI Brotli packages.

What component should be updated if the affected application uses Google Brotli directly?

Google Brotli version 1.2.1 has been published for the library itself. Downstream applications need releases that incorporate the corrected library version.

How can I identify potentially affected software in my environment?

Inventory software that directly or transitively uses Google Brotli, rather than limiting review to Node.js. The provided information specifically calls out Node.js 26.x, 24.x, and 22.x, as well as Bun, Envoy Proxy, Istio, and PyPI Brotli packages.

What should be done when an immediate application upgrade is not available?

The provided information does not describe a workaround or configuration-based mitigation. Review the application's dependency chain for Google Brotli and obtain a vendor release incorporating Brotli 1.2.1 when available.