Dear Customer, Dear Partner,
Scheduled: night of 23 to 24 October 2026, between 22:15 and 02:00 CEST.
We are deploying a security update to all Cloud Protector applications to protect them against CVE-2026-111497, an out-of-bounds write vulnerability in the Node.js Brotli decoder. Specially crafted Brotli-compressed content can corrupt memory in vulnerable Node.js backends, which may cause a crash or allow remote code execution.
Strict, temporary rule: to provide immediate protection, this rule blocks every request whose body is Brotli-compressed (Content-Encoding: br), whether malicious or not. It may therefore generate false positives on applications that legitimately send Brotli-compressed request bodies. Regular browser traffic is not affected. This rule is a temporary mitigation and is not intended to remain in place:
If your backend is not exposed to this vulnerability (it does not run Node.js, or does not decompress Brotli request bodies), the rule can be removed for your applications. If your backend is vulnerable, please update Node.js to a patched version first, then remove the rule.
Impact: no action is required on your side to benefit from the protection, and no service interruption is expected. The update is applied progressively to each application and takes effect within a minute of being applied.
Ubika team
Add this period to your calendar