Brotli

CVE-2026-111497 is a buffer overflow in Google’s Brotli decoder (1.0.3 to 1.2.0) that is compiled into Node.js, Bun, Envoy, Python Brotli wheels, .NET and the browsers. A crafted Content-Encoding: br body reaches it with no login. The upstream fix is tiny; finding every bundled copy is the work. This post ships six Fleet queries with version logic that does not trust SQLite string comparison, a policy pattern, and what the queries found on a real fleet (hint: Pillow bundles libbrotli 1.2.0).