Cyber ·
Brotli 1.2.1 fixes CVE-2026-111497 and downstream projects receive updates
An oss-sec mailing list notice dated 24 October 2026 reports the release of Brotli 1.2.1 with the fix for CVE-2026-111497 and lists other software that already includes the correction.
According to the notice forwarded to the oss-sec mailing list and posted by Alan Coopersmith on 24 October 2026, Brotli library version 1.2.1 has been released and includes the fix for CVE-2026-111497. The text is an automatic translation of the original feed, which should be consulted to confirm the details. A Patch the Planet page reports the same release and lists patched releases of Node.js, Bun, Envoy Proxy and Istio that include the correction, and suggests other software to check. A security company blog post adds the brotli packages on PyPI to the list, among others. The content does not state severity or attack vector in this version of the text, so that information should be sought directly from official sources. For administrators, the practical path is to identify where the library appears as a direct or indirect dependency, compare versions against those indicated by the projects, and apply the update recommended by each component's supplier. Rota Nacional does not patch third-party libraries, and this bulletin does not describe any platform feature for that task. If your team uses AI assistants to study the topic, do not paste credentials, internal inventories with server names, or personal data into them.