The bug. Brotli versions 1.0.3 through 1.2.0 mishandle an invalid "block switch" inside a compressed stream. Instead of stopping with an error, the decoder treats it as "I need more input" and keeps going in a broken state, which ends with a write past the end of a buffer. Fixed upstream releases are 1.0.10, 1.1.1 and 1.2.1. The CVE record credits OpenAI with the find.
Why it spreads. Brotli isn't one product. It's a small C library that gets copied into runtimes, proxies and language packages. Node.js bundles it, and Vercel's advisory says researchers showed memory disclosure and command execution in unpatched Node.js 22, 24 and 26 (fixed in 22.23.4, 24.22.1 and 26.12.1; Node 20 is end of life and gets no fix). Microsoft's .NET 8, 9 and 10 got out-of-band updates (8.0.33 is dated Oct 25), though .NET only decompresses Brotli if an app turns that on, and .NET Framework is not affected. JFrog's researchers point out the obvious trap: fixing Google's copy doesn't fix the copies everyone else ships.
Exploitation status. None of the advisories we read report attacks in the wild yet. Cloudflare's two new rules (one for requests that send Brotli-compressed bodies, one for the Next.js image optimizer path) ship in Log mode by default, so they only watch unless you switch them to Block.
What I'd do today. Treat this like a dependency hunt, not a single patch. First, upgrade Node.js everywhere you run it yourself: containers, CI runners and self-hosted Next.js. Second, push the .NET update to any service that turned on Brotli request or response decompression. Third, update Python's brotli package to 1.2.1. The risky spots are anything that unpacks compressed data it didn't create: an API that accepts compressed uploads, or a server that fetches and decompresses responses from third-party URLs. Your SCA tool (the scanner that lists open-source libraries in your code) should find the library, but it can miss copies compiled into binaries, so check vendor appliances and proxies too.