Brotli is a lossless data-compression format used to reduce the number of bytes needed to store or transfer content. It is especially common on the web, where servers compress text resources such as HTML, CSS and JavaScript and browsers decompress them without changing the original content. The format is documented in RFC 7932.
Compression and decompression do different jobs. An encoder turns ordinary data into a smaller Brotli stream; a decoder reconstructs the original bytes. Over HTTP, the Content-Encoding: br header identifies a Brotli-compressed representation. Applications can also use Brotli through language runtimes, libraries and other interfaces outside ordinary browser traffic.
Security depends on which direction data flows. A web server configured only to compress outgoing responses does not necessarily accept Brotli-compressed request bodies. A separate request parser, reverse proxy, client fetch operation or library may decompress untrusted data, however, and that is the type of path that matters for decoder vulnerabilities such as CVE-2026-111497.
When auditing Brotli exposure, inventory the decoder implementation and version actually loaded, not merely the web-server configuration or presence of .br files. Check each component that consumes compressed input, including application dependencies and embedded libraries. Update vulnerable decoders and test request handling when changing compression policies.