Threats affecting pkg:npm/brotli

CVE-2026-111497 is a critical out-of-bounds write vulnerability in Google's Brotli decompression library that allows specially crafted compressed data to corrupt application memory and potentially enable remote code execution. It affects Brotli versions 1.0.3 through 1.2.0 and multiple platforms including Node.js, Bun, Python, and .NET frameworks. Exploitation attempts were observed shortly after patches were released, with proof-of-concept code demonstrating remote code execution via malicious HTTP requests and responses. The vulnerability can be triggered through various vectors such as HTTP requests with Brotli-compressed bodies, malicious server responses, and file processing workflows. Enterprise products from Palo Alto Networks and VMware are also impacted, broadening the attack surface. CISA added this vulnerability to its KEV catalog on October 27, 2026.