cve-2026-111497

Brotli Decoder RCE Hits Node.js, Bun, Python and Envoy

CVE-2026-111497 is one C bug replicated across every runtime that ships Google's Brotli decoder. What's confirmed, what's claimed, and how to patch it all.