CVE-2026-111497
What makes you think it is? We don't use Node or .NET.
Thanks for your response Anton.
Exploitation of CVE-2026-111497 involves sending a specially crafted, compressed Brotli stream to a vulnerable application or server.
Brotli (as I understand it) is used as a standard way to compress web traffic, and almost every backend language bundles or compiles it. Java, .NET etc. etc.
I mentioned Node and .NET as examples without knowing what Traccar is built upon, but the key question is whether or not it uses Brotli compression.
This CVE is getting some focus as it can lead to RCE without authentication.
Traccar does not include or enable Brotli decoding in its standard server distribution. Its HTTP compression dependency is gzip, and the runtime dependencies do not include a Brotli implementation. Therefore, we found no exposure to this CVE in Traccar itself, including on Windows. Any separately installed reverse proxy would need to be assessed independently.
Thank you, understood, very helpful answer.
Hi there, I'm hoping to determine whether Traccar server on Windows is vulnerable to CVE-2026-111497.
The vulnerability spans a number of common dependencies such as Node.js and .NET.