Unity Updates Brotli Security Advisory With Patched Editor Versions

Unity updated its official Brotli decoder vulnerability advisory on November 7, 2026, identifying patched Editor builds across supported engine branches. The vulnerability was disclosed in October, so the new development is the refreshed remediation information, not a newly discovered flaw.

The issue concerns Brotli decompression in the .NET libraries that ship with Unity applications. The advisory makes an important distinction: an application's inclusion of those libraries does not automatically mean it exposes an exploitable input path. The risk arises when an affected application uses APIs such as BrotliStream or BrotliDecoder to process untrusted data, including content received from networks, player uploads or third-party services. Third-party plugins can introduce such paths even if game code never references the decoder directly.

Unity's November 7 table lists 6000.6.8f1 as a patched build for the 6000.6 branch, 6000.3.27f2 for 6000.3 LTS and 6000.0.85f2 for 6000.0 LTS. The advisory also includes corrected builds for 6000.7 beta and 7000.0 alpha. Developers should use the vendor's live table because the status of remaining patches can change.

The platform details prevent unnecessary alarm. Unity says WebGL output is not exposed through the browser's offline decompression of web build files, and the engine's usual asset bundle compression is not Brotli. UnityWebRequest does not itself use Brotli. The advisory also identifies a separate Editor-related concern involving Unity Package Manager clients interacting with malicious or impersonated scoped registries. Unity says it has no evidence that the vulnerability has been exploited in Unity applications.

A recommended audit starts by inventorying the exact Editor version used for each shipping build and searching the project's code and dependencies for Brotli-related decompression APIs. Where an untrusted path exists, upgrading to a patched branch and rebuilding affected applications is the safer approach. Teams should also review custom scoped registries and development machines.

This security update is relevant to the production pipeline and deployed games, not a new graphics feature. The key lesson is to combine version patching with an accurate understanding of how data enters an application.