Checked 2 November 2026: Unity's late-October security advisories describe two different problems. Developers should update their supported Editor branch, but should not assume every shipped game has the same exposure or rebuild requirement.
Brotli: inspect the data path
The Brotli advisory covers CVE-2026-111497. Runtime exposure requires decoding attacker-controlled data through BrotliStream, BrotliDecoder, or HttpClient with Brotli decompression enabled. Check plugins and third-party libraries too. Malicious compressed input can cause a crash or potentially code execution.
Unity says UnityWebRequest and AssetBundles do not use this decoder. Its WebGL build-file compression is also distinct: the browser decompresses those files. A Unity version number alone does not establish a game's Brotli exposure.
For exposed applications, update to a patched Editor, then rebuild and redistribute: updating the development machine does not replace the decoder already shipped to players. The Package Manager is another reason to update the Editor, because malicious or impersonated registries can expose its bundled components.
eMudhra: check platform trust separately
The certificate advisory concerns compromised certificate-authority keys and possible interception of encrypted traffic. Protection depends on the platform's certificate handling and security updates. Follow Unity's affected-platform table rather than treating all Windows, Apple, Linux and Android builds identically.
Unity recommends patched Editors for active projects, while saying rebuilding shipped applications is not generally required for this certificate issue. That is not the Brotli rebuild rule. Unity reports no evidence of exploitation against Unity applications in either advisory.
Use the patch for your branch
Both advisory tables, last updated 30 October, identify 6000.3.27f2 and 6000.7.0b7 as first fixed versions in those respective branches. The 6000.3.27f2 release notes confirm both fixes.
Our practical advice: back up, check the current branch-specific table and release notes, test the update, then distribute any required rebuilt demo or game. This is not a recommendation to move an LTS project onto a beta branch.
Original sources
- Unity — official October 2026 Brotli decoder advisory
- Unity — official October 2026 eMudhra certificate advisory
- Unity 6000.3.27f2 — October 30 release notes
- Unity Trust Center — October 29 security announcements
Release plans and availability can change. Check the original source for the latest information.