Brotli decoder CVE-2026-111497 enables RCE in Node.js 24 via fetch and Express on ARM64

The flaw resides in the shared Brotli decompression library reused across runtimes and proxies. Imperva demonstrated unauthenticated RCE on Linux ARM64 by supplying malicious payloads through fetch() or body-parser, achieving shell access after multiple attempts. No in-the-wild exploitation has been observed and the exploit remains private. OpenAI's Codex team disclosed the issue after internal discovery; fixes shipped first in Google Brotli 1.2.1 and Node.js 24.22.1. Python's Brotli and brotlicffi packages plus Envoy require separate updates because each vendor vendors its own copy of the decoder. Procurement records show Brotli remains embedded in defense-adjacent proxies without centralized patching. The pattern of decentralized library reuse creates persistent exposure windows in supply chains that ingest untrusted HTTP traffic. WAF rules deployed by Vercel cover only inbound requests, leaving outbound fetch paths open until the runtime itself is updated. Operational impact centers on any service accepting or retrieving br-encoded data. Next milestones are full Envoy and Istio rollout by late November and independent verification of exploit reliability on x86_64 builds.