REPORTED DEVELOPMENT
Official record: 22 October; fixed release: 21 October.
Google published CVE-2026-111497 with a CVSS 4.0 score of 9.2, Critical. Affected ranges are Brotli 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1, and 1.2.0 to before 1.2.1. Fixes are 1.0.10, 1.1.1 and 1.2.1; 1.2.1 was released on 21 October.
This is the vulnerability already reported by Node.js and Vercel, not a second vulnerability. Google's Critical and Node.js's High classifications retain their respective provenance.
WHY IT MATTERS TO THE MARKET
The official record extends dependency checks beyond Node.js runtimes to embedded Brotli libraries in applications, containers and executable components.