Do Son Brotli vulnerability CVE-2026-111497 affected products list: fixes for Node.js, .NET, Envoy, PAN-OS and distros, plus VMware and others still unpatched.
Envoy
The Envoy Project has patched two new vulnerabilities: a use-after-free bug that can lead to DoS (CVE-2025-54588) and a session-hijacking flaw in its OAuth2 filter.