Security statement: Brotli decoder vulnerability (CVE-2026-111497)
Last updated: October 30, 2026
Based on our assessment, Flexmonster Software does not expose the vulnerable Brotli decoder to attacker-controlled input. Flexmonster Data Server and the Flexmonster Admin Panel nevertheless include affected decoders in their bundled runtimes. We will release updated versions with patched runtimes by November 2, 2026.
Flexmonster Software.
- Flexmonster Pivot Table & Charts runs in the browser and does not bundle the Brotli library.
- Flexmonster Data Server bundles the .NET runtime. Versions up to and including 2.9.141 include an affected runtime version, earlier than .NET 8.0.33. Data Server does not enable Brotli request or response decompression or otherwise use .NET’s Brotli decompression APIs, so it does not pass data to the vulnerable decoder.
- Flexmonster Admin Panel is built on Electron, which includes Node.js. The application does not pass attacker-controlled Brotli data to the vulnerable decoder.
Planned updates. We will release the following updates by November 2, 2026:
- Flexmonster Data Server 2.9.142, built on .NET 8.0.33.
- Flexmonster Admin Panel 2.9.142, built on an Electron release that includes the fix for this vulnerability.
These updates will replace the affected runtime dependencies.
Systems operated by Flexmonster. The Flexmonster website does not use Node.js or .NET. The Client’s Area runs on Node.js but does not decompress Brotli data. We updated it to a patched Node.js release on October 22, 2026.
Action required. If you use Flexmonster Data Server or the Flexmonster Admin Panel, update to version 2.9.142 once it is available. You do not need to change their configuration while waiting for the updates. No update is required for Flexmonster Pivot Table & Charts in response to this vulnerability.
This statement reflects our assessment as of the date above, is provided for informational purposes only, and does not amend any agreement between you and Flexmonster.
If you have questions about this statement, please contact us through our contact form.