Clarify impact of CVE-2026-111497 on workerd #8004

I tried to open this via https://hackerone.com/cloudflare but am required to create a PoC for a published CVE in order to submit a report which really is a simple question.

CVE-2026-111497 is an out-of-bounds write in the Brotli decoder which affects Brotli 1.0.3 through 1.2.0, leading to potential RCE, and the fixed versions are 1.0.10, 1.1.1 and 1.2.1.

Upstream release: https://github.com/google/brotli/releases/tag/v1.2.1 (published 2026-10-21)

https://github.com/cloudflare/workerd/blob/v1.20261026.1/build/deps/gen/deps.MODULE.bazel#L24-L25 contains bazel_dep(name = "brotli", version = "1.2.0.bcr.3")

In the Bazel Central Registry, 1.2.0.bcr.3 is v1.2.0 with four build-only patches (Bazel 9 support and compiler-warning fixes). I think this means it is still technically vulnerable 1.2.0.

Cloudflare has shipped emergency changes to managed rulesets: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release/

Is a dependency bump required in workerd?

This is being asked over in the forums too:

• https://community.cloudflare.com/t/workers-workerd-brotli-security-fix-status-cve-2026-111497/971927
• https://community.cloudflare.com/t/workers-official-patch-status-for-brotli-cve-2026-111497/972103