Worth checking how brotli actually reaches your stack. In Node it's bundled into the runtime itself (zlib's brotli support), so an audit of your package tree won't surface it the way a normal dependency would - the fix arrives with a runtime release, not a package bump. The Python package on PyPI is already at 1.2.1. Until your runtime picks up the patched brotli, refusing br content-encoding at the edge seems like the fastest mitigation.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338
and this is the actual CVE report, which doesn't say much: https://www.cve.org/CVERecord?id=CVE-2026-111497
whether a hello wolrd in fastapi is affected might also be interesting