@nebulon sorry to jump in here.
CVE-2026-111497 is not just about NodeJS ( that node2shell name isn't great) but potentially anything using the same brotli decoder.
i.e. this page https://broccoli2shell.com/ gives an overview of software embedding libbrotli copy (similar as the 'fun' we had recently with the embedded ca-certs)
Looking at the 6.0.1 base-image it doesn't contain the libbrotli1 version with the Ubuntu fix yet (1.2.0-3ubuntu0.1) as that came just a few days later only
Looking what points to it (apt-rdepends)
apache2 (php container, but maybe less critical given the nginx as proxy on the host)
curl
non-http things (libwoff1, jxl (maybe via ffmpeg)
That's not a full or verified list just a first look.
Note: I'm also not shouting critical here just writing as above only talked about NodeJS angle.
Do you plan to bump the base image again for this?
Otherwise are the any plans to do that periodically to catch up to accumulated fixes which don't warrant the overhead of some immediate action?
