tl;dr: CVE-2026-111497 is a critical (CVSS 9.2) out-of-bounds write in Google's Brotli decoder (versions 1.0.3–1.2.0) that enables memory leaks or RCE from attacker-controlled compressed data, affecting Node.js, Python (Brotli/brotlicffi packages), Bun, Envoy, Istio, curl, and any HTTP client/server that decodes Brotli—often as a transitive dependency. OpenAI discovered it in February and the root cause was silently patched upstream, but no security release shipped until now; advisory databases haven't mapped it yet, so Dependabot/pip-audit won't flag it. Upgrade to Brotli 1.2.1+ (or vendor equivalents) immediately, or disable Brotli decoding as a workaround.