Manual interim workaround for CVE-2026-111497 (Brotli) on SDDC Manager 5.2.4, 9.0.2, 9.1.0

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

CVE-2026-111497 is a Critical severity vulnerability that impacts SDDC manager. This vulnerability and its impact on the mentioned VMware products are documented in the following VMware Security Advisory (VMSA), please review this document before continuing:

• VMSA-2026-0008

Environment

• VCF 5.2.x
• VCF 9.0.2, VCF 9.1.0

Resolution

1. The workaround described in this document is meant to be a temporary solution only and is intended to ONLY address CVE-2026-111497.

   1. Backup SDDC-M appliance.
   2. SSH to the SDDC Manager as vcf user and then change to root.
   3. Create the preload file:
      
      

      mkdir -p /etc/cve-111497
      cat > /etc/cve-111497/nobrotli.cjs <<'EOF'
      // CVE-2026-111497 interim: removes zlib.createBrotliDecompress, the decoder axios uses for br. 
      delete require('zlib').createBrotliDecompress;
      EOF
      chmod 644 /etc/cve-111497/nobrotli.cjs

   4. Add Environment for the UI service
      
      1. Change directory to /etc/systemd/system

cd /etc/systemd/system
         
         
      2. Take backup of file sddc-manager-ui-app.service

cp  sddc-manager-ui-app.service  sddc-manager-ui-app.service.bak
         
         
      3. Edit the file sddc-manager-ui-app.service and add the following line
         
         Environment=NODE_OPTIONS=--require=/etc/cve-111497/nobrotli.cjs
         
         Sample result:
         
         
         
      4. Restart the service using below commands
         
         systemctl daemon-reload
systemctl restart sddc-manager-ui-app
         
         
   5. Execute below script and wait for the UI to answer. A value other than 503 or 000 means the UI is up.
      
      

      for i in $(seq 1 40); do
        c=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:7500/ui/api/ping \
            -H 'Content-Type: application/json' --data-binary '{"a":1}')
        [ "$c" != 503 ] && [ "$c" != 000 ] && break
        sleep 6
      done
      echo "ui_code=$c"

   6. Verify
      
      
      1. Check that the service is running and the preload is loaded in the main process and in the forked child processes:
         
         systemctl show -p Environment sddc-manager-ui-app | tr ' ' '\n' | grep NODE_OPTIONS

Result: NODE_OPTIONS=--require=/etc/cve-111497/nobrotli.cjs
         
         Expected: the service is active, and every PID shows NODE_OPTIONS=--require=/etc/cve-111497/nobrotli.cjs.
         
         
      2. Check that the UI works: log in to the UI and open the Inventory and Domains pages.
         
         Expected: both pages load.
         
         
      3. Check the journal for Brotli or decompression errors since the restart using below command:
         
         journalctl -u sddc-manager-ui-app --since "10 min ago" --no-pager | grep -i -E 'brotli|zlib|decompress' | head -50
         
         Expected: Blank result (no lines)
         
         
   7. Roll back (Optional, if the UI doesn't work after following above steps)
      1. Restore SDDC-M or restore the file sddc-manager-ui-app.service taken in Step 4.b
         
         1. Change directory to /etc/systemd/system
            
            cd /etc/systemd/system
            
            
         2. Restore the file from the backup.
            
            cp  sddc-manager-ui-app.service.bak  sddc-manager-ui-app.service
            
            
      2. Remove the file /etc/cve-111497/nobrotli.cjs

rm -f /etc/cve-111497/nobrotli.cjs
         
         
      3. Reload and restart the service
         
         systemctl daemon-reload
systemctl restart sddc-manager-ui-app