What impact does the Brotli flaw have on OneAgent?
OneAgent doesn’t ship Node.js runtimes, and it uses Brotli decompression only for RUM injection. Client requests, including those from the public internet, can’t trigger this. To exploit it, an attacker would need to intercept the HTTP response chain and inject a malicious Brotli-compressed HTTP response. OneAgent would then decompress it. This would require the attacker to have already compromised the customer’s internal systems. As a precaution, we’ve updated the Brotli library in OneAgent and released fixes for supported versions. Other Dynatrace edge components are not impacted. → Security advisory
Update from November 04, 2026
Dynatrace team has finished the analysis of the Brotli vulnerability “HTTP2Shell” (CVE-2026-111497) and patched all impacted systems.
Update from October 28, 2026
Dynatrace team continues with the investigation. Patches are being applied where necessary. Please note that versions that are out of support do not receive security updates. Upgrade to latest or at least supported versions.
OneAgent Updates
Updates containing a patch for Dynatrace OneAgent are available. Please update OneAgent actively if OneAgent automatic updates are disabled:
- OneAgent 1.347.70.20261023-222553 and higher
- OneAgent 1.345.93.20261023-231338 and higher
-
OneAgent 1.343.124.20261024-104447 and higher
- OneAgent 1.341.95.20261023-230948 and higher
- OneAgent 1.339.97.20261023-232755 and higher
- OneAgent 1.337.88.20261023-234206 and higher
- OneAgent 1.335.92.20261024-143703 and higher
- OneAgent 1.333.84.20261024-143953 and higher
- OneAgent 1.331.71.20261024-160156 and higher
- OneAgent 1.329.98.20261024-105343 and higher
- OneAgent 1.327.84.20261024-092025 and higher
- OneAgent 1.325.91.20261024-215713 and higher
Other Dynatrace edge components (Managed, ActiveGate, Operator…) are not impacted by CVE-2026-111497.
Update from October 25, 2026
Dynatrace team continues with the investigation. Patches are being applied where necessary. Please note that versions that are out of support do not receive security updates. Upgrade to latest or at least supported versions.
OneAgent Updates
Updates containing a patch for Dynatrace OneAgent are available. Release Notes will follow. Please update OneAgent actively if OneAgent automatic updates are disabled:
- OneAgent 1.347
- OneAgent 1.345
- OneAgent 1.343
- OneAgent 1.341
- OneAgent 1.339
- OneAgent 1.337
- OneAgent 1.335
- OneAgent 1.333
- OneAgent 1.331
- OneAgent 1.329
- OneAgent 1.327
- OneAgent 1.325
Other Dynatrace edge components (Managed, ActiveGate, Operator…) are not impacted by CVE-2026-111497.
Update from October 24, 2026
Dynatrace team continues with the investigation. Patches are being applied where necessary.
OneAgent Updates
Updates containing a patch for Dynatrace OneAgent are available. Release Notes will follow. Please update OneAgent actively if OneAgent automatic updates are disabled:
- OneAgent 1.347
Updates for other supported OneAgent versions will follow shortly.
Other Dynatrace edge components (Managed, ActiveGate, Operator…) are not impacted by CVE-2026-111497.
Update from October 23, 2026
The Dynatrace team is actively reviewing the recently published news about the Node.js Brotli vulnerability (CVE-2026-111497) – Node2Shell.
Investigation is ongoing and patches are being applied where necessary.
