RHSB-2026-011 Network Stack Privilege Escalations

We are aware of Brotli decoder flaw which impacts Node.js

This impacts all 4.x customers, but only Metro uses the impacted code path for external connections. Customers who use the Metro Outlook Plugin are not impacted. 

It is important to note that while this vulnerability is reported as a Remote Code Execution (RCE) issue, a public Proof-of-Concept (PoC) published on October 22 reached code execution only against a deliberately weakened test build. On a standard Node.js build, its author reported a crash and a limited read of process memory, not code execution, and said a working attack on a normal build was not achieved. Subsequent PoC have required multiple attempts to achieve RCE. The impacted components within the VQCM are all served as micro-services, adding additional defence in depth for the VQCM product as a whole and further mitigating direct access to the host VM.

Customers who use Metro WebRTC and the Metro App should contact VQ Communications Support.

We are currently working on a VQCM release which will have a fixed version of Node.js instance and will update customers once this is available.

There is no known workaround or mitigation for this vulnerability – Companies such as Vercel have implemented Web Application Firewall (WAF) rules to block the inbound attack vector traffic. This will reduce exposure but does not replace patching. We are not aware of any public rules that have been made available at the moment, but as this vulnerability impacts Brotli based compression, customers with externally exposed instance should be focused on traffic using ‘Content-Encoding: br’.