Latest information about Brotli vulnerability CVE-2026-111497 in VertiGIS Studio products

VertiGIS uses this page to provide specific information about the critical vulnerability CVE-2026-111497 affecting software that uses the Google Brotli decoder, disclosed on October 22, 2026, and its impact on VertiGIS Studio products. 
This article will be updated as new information becomes available. 

We recommend applying the latest security patches from Microsoft and Esri to ensure system stability.

The following products do not use any Brotli decoders specifically and are not affected:

• VertiGIS Studio Web
• VertiGIS Studio Mobile
• VertiGIS Studio Workflow
• VertiGIS Studio Item Manager
• VertiGIS Inline
• VertiGIS Studio Search

The following products are under investigation:

• VertiGIS Studio Printing
• VertiGIS Studio Reporting

The following products are affected:

• VertiGIS Studio Access Control (resolved in release 5.9.1)
• VertiGIS Studio Analytics (resolved in release 1.8.1)

These products use node to deliver content. We have released a new version of each product with an updated version of node that does not contain the Brotli vulnerability.