🧑💻 Behind every CVE there are humans working hard to release fixes as soon as possible, coordinating across projects and time zones, and often as volunteers. The fix is the visible part. The hours of triage, testing, backports and coordination are not.
Thanks to Patch the Planet for naming them in the Brotli disclosure. Proud of how we handled this one at @nodejs and @openjsf, working together with the Brotli, Envoy and Istio maintainers.
Patch the PlanetBrotli vulnerability (CVE-2026-111497) — Patch the PlanetBrotli decoder vulnerability: affected software, fixed releases, and how to disable Brotli decoding while you patch.