You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Docker image: update Node for CVE-2026-111497 (24.22.1) #2196
I run the official 2.7.6 image, and the Node.js it ships is 20.19.5. That build is affected by CVE-2026-111497, a vulnerability in Node's Brotli decoder that can lead to remote code execution, fixed on 21 October 2026 in Node 22.23.4, 24.22.1, and 26.12.1 (https://nodejs.org/en/blog/vulnerability). Node 14, 16, 18, 19, 20, 21, 23, and 25 are end of life and will not get this patch, so the runtime needs to be on 22.23.4, 24.22.1, or 26.12.1. I could not find a commit, pull request, or issue that moves this image onto a patched Node release (Node 20 EOL, all-in-one image, nothing filed). Pointing the Docker build at Node 24.22.1 and publishing a new tag would fix the image I am running. I am happy to open a pull request if you want one.
Activity
cedric-mertig commentedon Oct 30, 2026
Ah I didnt see your issue so I had opened my own under #2198