Brotli

The Brotli decoder flaw CVE-2026-111497, first seen in Node.js, also hits .NET, Python packages and Envoy; Microsoft issued emergency patches on October 25, 2026.

Node.js patched Node2Shell (CVE-2026-111497), a Brotli decoder flaw rated up to 9.8 in severity, on October 21, 2026; researchers have shown a proof of concept.