# Appwrite 2.6.2 — Release & Upgrade Intelligence
- **Product:** Appwrite (https://appwrite.io)
- **Version:** 2.6.2
- **Released:** Oct 24, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/appwrite/updates/2.6.2/

## Executive Summary (TL;DR)
Appwrite 2.6.2. Source highlight: Appwrite 2.6.2 is a security release for self-hosted deployments on the 2.6 line. It brings the hardening work merged since 2.6.1 across auth, API keys, databases, realtime, GraphQL, storage, VCS, functions, sites, migrations and messaging. It also moves the runtime to a patched Brotli and the Conso

## Bug Fixes
- **Brotli CVE-2026-111497.** `appwrite/base` 2.2.7 updates `brotli-libs` from 1.2.0-r1 to 1.2.1-r0. 1.2.1 fixes an out-of-bounds write in the Brotli **decoder**. Appwrite is exposed through its outbound HTTP client: when a caller doesn't set `Accept-Encoding`, the cURL adapter accepts and decodes `br`, and the avatar image and favicon endpoints fetch user-supplied URLs that way. The Swoole HTTP client links the same library (#14765).
- **Console 1.2.108**, which includes the DOMPurify sanitization fixes (#14892).
- Clear pending recovery tokens when the account email changes (#14347).
- Authenticate API keys before skipping Origin checks (#14352).
- Apply project email policies to ID-token sign-in (#14633).
- Match existing users by exact email on OAuth and ID-token sign-in (#14778).