India, Oct. 29 -- The Indian Computer Emergency Response Team (CERT-In) has issued a critical security advisory warning enterprise IT teams, developers and CIOs about a vulnerability in Google's Brotli compression library.

The out-of-bounds write vulnerability, tracked as CVE-2026-111497, could allow an attacker to corrupt memory, disrupt services, disclose sensitive information or potentially execute code if an affected application decompresses specially crafted, untrusted data.

The warning has implications for Indian organisations using affected versions of Node.js, Bun, .NET, Envoy, Istio and other software that uses the Brotli decoder.

However, not every installation of these products is automatically vulnerable. Organisations need...