CISA put the Brotli decoder bug on its catalogue. The entry names a library, not a product, and that is the whole problem
2026-10-28Security
CVE-2026-111497 was added on 27 October with a due date of 10 November. The catalogue lists Google Brotli, and the fix arrives separately in Node, .NET, Bun, Envoy, Istio, the PHP Windows builds and your distribution's own package.