Manual interim workaround for CVE-2026-111497 (Brotli) on SDDC Manager 5.2.x, 9.0.2, 9.1.0

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

CVE-2026-111497 is a Critical severity vulnerability that impacts SDDC manager. This vulnerability and its impact on the mentioned VMware products are documented in the following VMware Security Advisory (VMSA), please review this document before continuing:

• VMSA-2026-0008

Environment

• VCF 5.2.x
• VCF 9.0.2, VCF 9.1.0

Resolution

Note: If your SDDC Manager is on 9.1.1.x please follow the steps in KB, "Manual interim workaround for CVE-2026-111497 (Brotli) on SDDC Manager 9.1.1.x"

 

The workaround described in this document is meant to be a temporary solution only and is intended to ONLY address CVE-2026-111497.

1. Backup SDDC-M appliance.
2. SSH to the SDDC Manager as vcf user and then change to root.
3. Create the preload file:
   
   

   mkdir -p /etc/cve-111497
   cat > /etc/cve-111497/nobrotli.cjs <<'EOF'
   // CVE-2026-111497 interim: removes zlib.createBrotliDecompress, the decoder axios uses for br. 
   delete require('zlib').createBrotliDecompress;
   EOF
   chmod 644 /etc/cve-111497/nobrotli.cjs
   chmod 755 /etc/cve-111497

4. Add Environment for the UI service
   
   1. Change directory to /etc/systemd/system

cd /etc/systemd/system
      
      
   2. Take backup of file sddc-manager-ui-app.service

cp  sddc-manager-ui-app.service  sddc-manager-ui-app.service.bak
      
      
   3. Edit the file sddc-manager-ui-app.service and add the following line
      
      Environment=NODE_OPTIONS=--require=/etc/cve-111497/nobrotli.cjs
      
      Sample result:
      
      
      
   4. Restart the service using below commands
      
      systemctl daemon-reload
systemctl restart sddc-manager-ui-app
      
      
5. Execute below script and wait for the UI to answer. A value other than 503 or 000 means the UI is up.
   
   

   for i in $(seq 1 40); do
     c=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:7500/ui/api/ping \
         -H 'Content-Type: application/json' --data-binary '{"a":1}')
     [ "$c" != 503 ] && [ "$c" != 000 ] && break
     sleep 6
   done;
   echo "ui_code=$c"

6. Verify
   
   
   1. Check that the service is running and the preload is loaded in the main process and in the forked child processes:
      
      systemctl show -p Environment sddc-manager-ui-app | tr ' ' '\n' | grep NODE_OPTIONS

Result: NODE_OPTIONS=--require=/etc/cve-111497/nobrotli.cjs
      
      Expected: the service is active, and every PID shows NODE_OPTIONS=--require=/etc/cve-111497/nobrotli.cjs.
      
      
   2. Check that the UI works: log in to the UI and open the Inventory and Domains pages.
      
      Expected: both pages load.
      
      
   3. Check the journal for Brotli or decompression errors since the restart using below command:
      
      journalctl -u sddc-manager-ui-app --since "10 min ago" --no-pager | grep -i -E 'brotli|zlib|decompress' | head -50
      
      Expected: Blank result (no lines)
      
      
7. Roll back (Optional, if the UI doesn't work after following above steps)
   1. Restore SDDC-M or restore the file sddc-manager-ui-app.service taken in Step 4.b
      
      1. Change directory to /etc/systemd/system
         
         cd /etc/systemd/system
         
         
      2. Restore the file from the backup.
         
         cp  sddc-manager-ui-app.service.bak  sddc-manager-ui-app.service
         
         
   2. Remove the file /etc/cve-111497/nobrotli.cjs

rm -f /etc/cve-111497/nobrotli.cjs
      
      
   3. Reload and restart the service
      
      systemctl daemon-reload
systemctl restart sddc-manager-ui-app

Additional Information

VMSA-2026-0008: Node.js Brotli decoder out-of-bounds write remote code execution vulnerability (CVE-2026-111497)