SECURITY: Immich and ReleaseBell packages still on Node 24.21.0 (CVE-2026-111497, Brotli)

[imc67]

@girish @nebulon the Immich and ReleaseBell packages still run Node v24.21.0, while other packages I checked already moved to 24.22.1 after the October Node security release.

Package	Version	Node of the running process
Immich	1.103.11	v24.21.0 (/usr/local/node-24.21.0/bin/node)
ReleaseBell	1.15.0	v24.21.0 (/usr/local/node/bin/node)

Why I think this matters:

• CVE-2026-111497 (out-of-bounds write in the Brotli decoder) is fixed in Node 24.22.1 and was added to CISA KEV on 27-10.
• Both apps ship body-parser 2.3.0, which handles Content-Encoding: br. On Immich I confirmed with a harmless compressed request that the login endpoint decompresses the body before authentication. ReleaseBell's body parser also runs before routing. I did not try the actual exploit, so I can't say whether it works on these builds.
• The app access settings in Cloudron don't help here, as the request reaches the app without a login.

Could these two get a rebuild on the updated Node? It may also be worth checking whether other packages pin Node the same way.

[james]

Hello @imc67
We are aware and are already working on it.

[imc67]

@james thanks! Related: cloudron/php-base:8.5-20261021 and the current WordPress package (3.17.1) still ship libbrotli1 1.2.0-3build1, while the Ubuntu fix for CVE-2026-111497 is 1.2.0-3ubuntu0.1. PHP apps reach this through libcurl, as WordPress decodes Brotli on outbound requests (see Patchstack's write-up, https://patchstack.com/articles/wordpress-doesnt-ship-brotli-its-still-exposed-to-cve-2026-111497/). Could the PHP base get a rebuild as well?