# Snyk: Trust page changed > Snyk added a security advisory for Brotli CVE-2026-111497 (CVSS 9.2), recommending updates, restarts and container rebuilds. It clarifies that Open Source scanning misses runtimes; customers should also use Unmanaged scanning and Snyk Container to find affected copies. The Klue/Salesforce investigat Canonical: https://rewindex.com/change/p10516 Last updated: 2026-10-29T09:03:40Z **Summary:** Snyk added a security advisory for Brotli CVE-2026-111497 (CVSS 9.2), recommending updates, restarts and container rebuilds. It clarifies that Open Source scanning misses runtimes; customers should also use Unmanaged scanning and Snyk Container to find affected copies. The Klue/Salesforce investigation closing notice and documentation-on-request text were removed. _(machine-written, sol)_ - Kind: Trust / security · Label: Changed (not classified) (rule) - Changed: 2026-10-29 09:03 UTC · Detected: 2026-10-29 09:03 UTC - [Source: https://trust.snyk.io](https://trust.snyk.io) - [Company: Snyk](https://rewindex.com/company/snyk.md) - Versions: before page\_version:5414 → after page\_version:10516 - Change 2 of 3 for this page ## What changed **1. Added** ```diff …Snyk's Privacy Policy and DPA? Updates View all + Security Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497) Published ‹date› Overview On October 21, Google released… ``` **2. Added** ```diff …Vulnerability (CVE-2026-111497) Published ‹date› Overview On October 21, + Google released Brotli 1.0.10, 1.1.1, and 1.2.1 to fix a critical out-of-bounds write in its Brotli C decoder ( CVE-2026-111497 Opens in new tab , CVSS 9.2) that can lead to remote code execution. If you run an affected… ``` **3. Added** ```diff …lead to remote code execution. If you run + an affected component, you should immediately update to the vendor’s fixed release, for example Node.js 26.12.1, 24.22.1 or 22.23.4, or .NET 8.0.33, 9.0.22 or 10.0.14, then restart or redeploy. Node.js 25 and older lines are end-of-life and receive no fix. Many runtimes, language packages, Linux distributions and products bundle their own copy of the decoder, and each needs its own update. If you only use Snyk Open Source scanning,… ``` **4. Added** ```diff …Snyk Open Source scanning, you will not see + runtimes such as Node.js in your results. That doesn’t mean you are… ``` **5. Added** ```diff …you Snyk Open Source (CLI and SCM integration) + reports dedicated advisories for packages that bundle the decoder, such as Brotli and brotlicffi on PyPI, the Ruby brotli gem, kjdev/brotli on Composer, and .NET runtime packs on NuGet. It does not report runtimes because they are not declared dependencies. Snyk reports runtimes and vendored copies of the Brotli C source through Unmanaged scanning (snyk test --unmanaged) and, for… ``` **6. Added** ```diff …as each distribution publishes its advisory. Snyk advisories: + all advisories for CVE-2026-111497 Opens in new tab . What you should… ``` **7. Added** ```diff …for CVE-2026-111497 Opens in new tab . What + you should do Use Snyk Open Source, Unmanaged scanning and Snyk Container together to find every copy of the decoder, update each one, then restart processes and rebuild container images. What we are doing Advisories published and updated:… ``` **8. Added** ```diff …Advisories published and updated: we published advisories for + the Node.js runtime and the Brotli C library on October 22, the day the CVE was published, and we publish dedicated advisories as we confirm other packages that bundle the decoder. More coverage on the way: we add Linux distribution advisories to Snyk Container as each distribution reports them. If you have questions, please contact your Snyk… ``` **9. Added** ```diff …team or Support. Read more Read more about + Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497) General Zero-Day Incident - PHP Remote Code Execution… ``` **10. Removed** ```diff …Incident - Keyv / Cacheable - Update #1 - General Closing Update - Third-Party Vendor Security Incident — Klue Published ‹date› Status: Investigation Complete — ‹date› Snyk's forensic investigation into the June 2026 Klue/Salesforce incident is now complete. The investigation confirmed no impact beyond what was disclosed in our June 22 communications: business CRM data only (contact information, account details, sales and contract records, and support case titles and descriptions). Case comments, attachments, and the Snyk platform were not affected. All impacted customers were notified directly and the data involved is consistent with what was disclosed in our June 22 blog post Opens in new tab . Documentation available… ``` **11. Removed** ```diff …22 blog post Opens in new tab . - Documentation available upon request: Mandiant Security Memo Customer-specific data export Questions: support@snyk.io Read more Read more about Closing Update - Third-Party Vendor Security Incident — Klue Opens in new tab Subscribe to updates The… ``` _1 noise-only block(s) hidden (dates, counters, testimonials, tokens)._ ## History of this page | When (UTC) | Change | Label | | --- | --- | --- | | 2026-10-22 08:57 UTC | [Trust page changed](https://rewindex.com/change/p5414.md) | Changed (not classified) | | 2026-10-29 09:03 UTC | Trust page changed (this change) | Changed (not classified) | | 2026-10-31 09:00 UTC | [Trust page changed](https://rewindex.com/change/p12090.md) | Changed (not classified) | Previous: [change](https://rewindex.com/change/p5414.md) · Next: [change](https://rewindex.com/change/p12090.md) · All Snyk changes: [timeline](https://rewindex.com/company/snyk/changes.md) _Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._ --- Canonical: https://rewindex.com/change/p10516 · Markdown: https://rewindex.com/change/p10516.md · JSON: https://rewindex.com/api/v1/changes/p10516 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T13:16:52.551Z