Last Updated: October 27, 2026 at 4:00PM (EST)
Status: Under Investigation
Solace is aware of the recently reported Brotli decoder (Node2Shell/HTTP2Shell) vulnerabilities and is performing a full analysis of our exposure: CVE-2026-111497. This page will be updated as new information becomes available.
Initial Analysis
Solace Event Broker
- The Solace Event Broker is not impacted. However, it contains an affected RPM, which is unused and therefore not exploitable.
- This RPM will be removed in a future release.
Solace Cloud
- Numerous Solace Cloud console components are exposed to this vulnerability.
- Solace has begun patching all affected services on a priority basis.
Solace Schema Registry
- Solace Schema Registry versions 1.0.0 through 1.1.2 are impacted.
- Solace will release version 1.1.3 to resolve this vulnerability. This release is targeted for November 5, 2026.
Solace Micro-Integrations
- All versions of all Solace Micro-Integrations are exposed to this vulnerability.
- Solace will resolve this exposure in all Micro-Integrations. We are awaiting upstream fixes, so no ETA is available yet.
Solace Messaging APIs
- Solace Messaging API for JavaScript, Solace PubSub+ OpenTelemetry Integration for Solace JavaScript API, and sdkperf_js are not impacted.