This update relates to the recently disclosed Brotli compression vulnerability CVE-2026-111497
We have found no evidence that this vulnerability has affected our platform or your data, and no action is needed from you.
Our main application runs on Java and is not affected. Our continuous infrastructure scanning identified the vulnerable library in three places: a dependency bundled with libraries our Java application uses, some serverless functions running on Node.js, and the build tooling for some front-end applications. In each case we have found no use of the affected functionality. The build tooling is not part of the externally facing platform.
We are patching every instance regardless, and expect this to be complete by [date]. We will confirm once it is done.