Problem

CVE-2026-111497 is a critical buffer overflow (CVSS 9.8) in the Google Brotli decoder, versions 1.0.3 through 1.2.0. A remote unauthenticated attacker can use a crafted Brotli stream to cause memory disclosure, denial of service, or potentially remote code execution. Brotli is built into Node.js, Python applications, and some proxies and service meshes.

Resolution

SecureTransport is not impacted. It does not use Node.js. No action is required.