grep -rl "CVE-2026-111497" ./articles
CVE-2026-111497 is a 9.8 in the compression library inside every browser. The commit that fixes it was pushed to public master on 27 February and no release carried it for 236 days.
Root Notes reports on this identifier; it does not maintain it. For the vendor advisory, the affected versions and the scoring, NVD and MITRE hold the primary records.
CISA added this identifier to its Known Exploited Vulnerabilities catalog on 2026-10-27, which means the agency has evidence of exploitation rather than a judgement that exploitation is possible. US federal agencies were required to remediate it by 2026-11-10.
CVE-2026-111497 is a 9.8 in the compression library inside every browser. The commit that fixes it was pushed to public master on 27 February and no release carried it for 236 days.
CVE-2026-111497 was added on 27 October with a due date of 10 November. The catalogue lists Google Brotli, and the fix arrives separately in Node, .NET, Bun, Envoy, Istio, the PHP Windows builds and your distribution's own package.
CVE-2026-111497 is an out-of-bounds write in the Brotli decoder, scored 9.2 by Google and High by Node. The exposure most people have is fetch, which decodes Brotli on the response's say-so.
../cve — every identifier we have covered