2026-10-30

Response Status for the Out-of-Bounds Write Vulnerability in the C Implementation of Brotli (CVE-2026-111497)

This notice describes Kuroco's response to the out-of-bounds write vulnerability in the C implementation of Brotli (CVE-2026-111497).

Response status

Target	Status
Kuroco API and admin panel	Not affected by these vulnerabilities.
Some features that use Node.js (mainly related to KurocoFront)	These run on Google Cloud managed services, and the response was completed on 2026/10/24.

References

• JPCERT/CC: Alert regarding an out-of-bounds write vulnerability in the C implementation of Brotli (CVE-2026-111497) (Japanese)
• Cloud Run functions release notes
• App Engine standard environment (Node.js) release notes

Contact

If you have any questions regarding this matter, please contact Kuroco support.

• Support

Related documents

• Security Advisories
• Security Center