Audit finds scanner blind spot for Brotli RCE

CVE-2026-111497 (Node2Shell, CVSS 9.2) in the Brotli decoder allows remote code execution. For about 48 hours advisory databases did not map the CVE to PyPI packages, so pip-audit and Dependabot missed it. A patched Node.js runtime still reports the vulnerable Brotli 1.2.0.

• CVE-2026-111497 in the Brotli decoder carries a CVSS score of 9.2
• The PyPI scanner blind spot lasted roughly 48 hours
• The only fixed Python package line is 1.2.1
• Patched Node.js 24.22.1 still reports Brotli 1.2.0