Is Statseeker vulnerable to CVE-2026-111497 (the Node.js - Google Brotli vulnerability)?
Although the vulnerable library is present in Statseeker 26.3 and earlier, Engineering has not identified an exploitable path through normal product functionality.
Engineering has reviewed CVE-2026-111497 and confirmed the following:
-
Affected versions: Statseeker 26.3 and earlier contain a vulnerable version of the Brotli library.
- Application impact: Engineering has not identified any Statseeker application code paths that use the affected Brotli decompression functionality.
- Exploitability: Exploitation through normal Statseeker application operations is considered unlikely. Potential exposure remains if users manually execute curl commands or custom web-based code that processes malicious Brotli-compressed data.
-
Risk assessment: Low, based on the absence of identified application code paths using the vulnerable functionality.
-
Remediation: Statseeker 26.4 will include the patched Brotli library.
-
Conclusion: Although the vulnerable library is present in Statseeker 26.3 and earlier, Engineering has not identified an exploitable path through normal product functionality.
The vulnerability has been recorded in the Statseeker Vulnerability Register and will be tracked until the patched library is confirmed in the released version of Statseeker 26.4.
Please note: We do not have a release date for Statseeker 26.4 at this point but this version should be available in mid to late November.