Google Brotli Team

New Capabilities

Shipped patched releases 1.0.10, 1.1.1, and 1.2.1 on October 21

A memory bug in Google's Brotli decompressor lets a crafted compressed file overwrite memory in any program that unpacks it. The flaw, CVE-2026-111497, scores 9.2 out of 10, and researchers at Imperva ran attacker code on an unpatched Node.js build by feeding it Brotli data.

Updated Nov 1