The release page says an out-of-bounds write “permits remote code execution.” The release is identified as the latest version on the repository’s GitHub releases page.
The page lists the tag as v1.2.1 and attributes its publication to the account eustas on October 21. Its release note contains only the CVE identifier and the brief security statement. The page also shows downloadable release assets, but the note does not describe source changes, affected components, or upgrade instructions.
The source establishes that Brotli v1.2.1 is a security release for this issue and that the project characterizes the flaw as an out-of-bounds write that can permit remote code execution. It does not establish which applications or deployments are affected, the conditions required to exploit the flaw, whether exploitation has occurred, whether downstream packages have updated, or whether other maintained Brotli branches contain corresponding fixes.