TL;DR: The servers behind Smart Wishlist and Smart RSS Feed are immune to the Brotli vulnerability CVE-2026-111497 that made headlines this week, and you don’t need to do anything.
What happened?
Brotli is a compression format created by Google. Websites use it to shrink pages and data so they load faster, much like zipping a file before emailing it. It is built into many web servers, browsers and programming tools.
On October 21, 2026, the Node.js project disclosed a flaw in the part of Brotli that unpacks compressed data. A specially crafted file could make a vulnerable program write to the wrong place in memory. Depending on the program, that can cause a crash, expose data held in memory, or in the worst case let an attacker run their own code. Google rated it 9.2 out of 10 (critical), and working demonstration exploits have been published, which is why it received so much attention.
The important detail is that the risk only exists where software decompresses Brotli data that came from an untrusted source. Fixed versions of the Brotli library (1.0.10, 1.1.1 and 1.2.1) have been released, and operating system vendors such as Debian, Ubuntu and Fedora have shipped updates.
Our exposure?
Smart Wishlist and Smart RSS Feed do not use Brotli at all, so neither app is exposed to this vulnerability. We audited our systems after the disclosure to be sure, and as of October 29, 2026 we have confirmed the following.
Brotli is present on our servers only as part of a standard networking component that ships with our server software. That component has been updated with the security fix, and our apps never call it.
We continue to apply security updates as vendors release them.
Why the “br” header on your wishlist or rss feed page is not a concern?
Some merchants and developers noticed that responses from the wishlist page (/a/wishlist), including its API responses, carry the header content-encoding: br. That header simply says the response was compressed with Brotli before being sent.
We have confirmed Shopify applies that brotli compression ( and the br header) to app proxy pages responses automatically. It is a platform setting that neither we developers nor merchants control, and it works in the safe direction: Shopify compresses the page, and your shopper’s browser decompresses it. The attacks researchers have demonstrated target server-side software and developer tools that decompress data, and your shopper’s browser is updated separately by its maker.
So seeing br on a response does not mean you are exposed. It only means your page is being delivered in a smaller, faster form.
Is this CVE fixed at Shopify?
Shopify runs its own network, and we have no visibility into or control over its software. Large platforms like Shopify generally patch issues like this quickly, and the exposure depends on whether their systems decompress untrusted Brotli data, which is separate from the compression behind the br header. Shopify is best placed to speak for its own systems, and its security team will have its own process for handling issues like this. If you need an official position for your own compliance work, Shopify’s security and developer channels can provide it.
What you need to do?
Nothing. There is no app update to install, no setting to change and no action needed in your Shopify admin. Smart Wishlist and Smart RSS Feed keep working as usual.
As general good practice, it is worth keeping any other apps and tools you use up to date, since the fixes for this flaw are rolling out across many products. If a vendor you rely on has posted a security notice about CVE-2026-111497, follow their instructions.
Questions?
If you have any questions about this or anything else to do with security in Smart Wishlist or Smart RSS Feed, contact our support team and we’ll be glad to help.