On October 21, 2026, the Google Brotli and Node.js projects disclosed CVE-2026-111497 ("Node2Shell"), an out-of-bounds write in the Brotli decompression library (CVSS 4.0: 9.2 Critical). We have assessed every supported Metric Insights release.
- 7.2.1 Security Builds and 7.2.2beta1: not exploitable. No action is required.
- 7.1.2a and 7.0.1a: low risk. The Chromium browser used by the Image Generator and Data Processor services includes an affected Brotli version. It can be reached only through BI tools configured by your administrators and through content added by authenticated users with content-editing rights. No configuration change is required; we recommend updating to the current 7.2.1 Security Builds or to 7.2.2.
- Node.js: an affected version is present on all releases, but it never decodes Brotli data and is not exploitable. The 7.2.2 GA release is planned to update Node.js to 24.22.1 or newer.
- Debian Brotli library: affected, with no Debian fix released yet. It is reachable only through services configured by an administrator (low risk). We will rebuild our images once Debian publishes a fix.
See the security position statement for each release coverage, the reasoning behind these ratings, and the commands for checking installed versions. For questions, contact support@metricinsights.com.