Brotli CVE-2026-111497 outside Node.js and Python: which libbrotli and Envoy versions fix the decoder out-of-bounds write (GHSA-3wvj-j6qm-62mr)?

Am I affected: CVE-2026-111497 is an out-of-bounds write in the Brotli decoder in Google's reference C library. Decoding attacker-supplied Brotli data can lead to remote code execution. Anything that decompresses untrusted Brotli input with a vulnerable libbrotli is exposed: HTTP clients and proxies that accept Content-Encoding: br, curl/libcurl builds linked against libbrotli, and services that decode uploaded or proxied data. Compressing data is not the risky path; decoding is. Envoy is affected only when the Brotli decompressor filter is explicitly configured. Per Aikido's analysis, stock Apache mod_brotli and nginx do not decode Brotli by default. How to check: - System library: check the installed version with your package manager (for example 'dpkg -l | grep -i brotli' or 'rpm -q libbrotli'), and check your distro's security tracker for a backported fix. Distros often patch without changing the upstream version number. - Vendored copies: search your dependency tree and containers for bundled brotli sources or static builds. Static binaries need a rebuild. - Envoy: run 'envoy --version' and search your config for envoy.filters.http.decompressor with the brotli decompressor library. Fix: - libbrotli (google/brotli): 1.2.1, or the patched older lines 1.1.1 / 1.0.10, or your distro's security update. Then restart or rebuild everything that links it. - Envoy: 1.40.0, 1.39.3, 1.38.6 or 1.37.8 (1.36.12 also has the fix but that line is out of support). - curl/libcurl: update the libbrotli it links against (or take your vendor's fixed curl package). - Products that embed Envoy or Brotli (service meshes, API gateways, language runtimes): follow each vendor's bulletin. Node.js and Python have separate fixes. Interim mitigation: if you can't patch yet, stop decoding Brotli from untrusted sources. Remove the Brotli decompressor filter in Envoy, and stop advertising 'br' in Accept-Encoding from clients that talk to untrusted servers. Envoy's advisory lists no other workaround. After patching: confirm that long-running processes have restarted and loaded the new library (on Linux, 'lsof | grep brotli' shows which processes still map the old file). Rebuild container images rather than relying on the base image tag, and watch for crashes in decompression paths. Sources: https://github.com/google/brotli/releases https://github.com/envoyproxy/envoy/security/advisories/GHSA-3wvj-j6qm-62mr https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497