Status: Remediated (Preview/SaaS) / Updates Scheduled (SDCX & Flight Deck)
On October 21, 2026, a vulnerability was disclosed in Google’s Brotli compression decoder (CVE-2026-111497), impacting downstream runtimes and platforms (including Node.js) that package bundled Brotli decoding logic.
The Signiant Security and Engineering teams have evaluated all General Availability (GA) enterprise products, early-access preview environments, and hosted SaaS control planes. While our analysis confirms that core data paths do not expose exploitable vectors to untrusted Brotli payloads, updated maintenance releases are scheduled next week to ensure all packaged dependencies are patched and customer security scans remain clear.
Scope & Status Matrix
Product / Service Line | Status | Remediation & Release Details |
Preview & Limited Availability (LA) Services (e.g., Model Context Protocol / MCP Services) | Remediated | Early-access and containerized environments operating on affected runtimes have been updated with patched dependencies and redeployed. Mitigation is complete. |
Signiant SDCX Server | Release Scheduled | Remediation will be delivered in SDCX Server v7.4.1. The release is currently in final testing and is targeted for availability mid next week (week of November 2, 2026). |
Flight Deck | Release Scheduled (Non-Exploitable) | Deemed non-exploitable based on Signiant’s operational implementation and architectural execution paths. To resolve upstream library scanner findings, an update will be delivered in Flight Deck v16.2.1, targeted for mid-to-late next week (week of November 2, 2026). |
Signiant SaaS & Platform Control Plane | Not Affected | Core multi-tenant control planes, routing proxies, and cloud storage connectors are protected and do not decompress untrusted Brotli payloads. |
Customer Action Required
SDCX Server: Upgrade to SDCX Server v7.4.1 once published next week. (Deployments with automatic updates enabled will receive the release automatically.)
Flight Deck: Upgrade to Flight Deck v16.2.1 once published next week to address any software composition analysis (SCA) or vulnerability scan findings in your environment.
Preview & LA Participants: No action is required. All cloud-hosted MCP and early-access services have already been remediated in place.
Advisory Updates
This advisory will be updated with direct download links and release notes as soon as SDCX Server v7.4.1 and Flight Deck v16.2.1 become available. For further technical questions, submit a request via the Signiant Customer Support Portal.