Node.js shipped the Brotli fix on Tuesday. Google's own CVE record says the change went public in February
2026-10-24Security
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, scored 9.2 by Google and High by Node. The exposure most people have is fetch, which decodes Brotli on the response's say-so.