<![CDATA[NodeJS CVE]]>Should we be worried / taking steps?

https://www.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce

]]>https://forum.cloudron.io/topic/16205/nodejs-cveRSS for NodeFri, 30 Oct 2026 07:35:34 GMTWed, 28 Oct 2026 17:14:53 GMT60<![CDATA[Reply to NodeJS CVE on Thu, 29 Oct 2026 09:45:11 GMT]]>@nebulon sorry to jump in here.

CVE-2026-111497 is not just about NodeJS ( that node2shell name isn't great) but potentially anything using the same brotli decoder.
i.e. this page https://broccoli2shell.com/ gives an overview of software embedding libbrotli copy (similar as the 'fun' we had recently with the embedded ca-certs)

Looking at the 6.0.1 base-image it doesn't contain the libbrotli1 version with the Ubuntu fix yet (1.2.0-3ubuntu0.1) as that came just a few days later only 😞
Looking what points to it (apt-rdepends)

  • apache2 (php container, but maybe less critical given the nginx as proxy on the host)
  • curl
  • non-http things (libwoff1, jxl (maybe via ffmpeg)

That's not a full or verified list just a first look.
Note: I'm also not shouting critical here just writing as above only talked about NodeJS angle.

Do you plan to bump the base image again for this?
Otherwise are the any plans to do that periodically to catch up to accumulated fixes which don't warrant the overhead of some immediate action?

]]>https://forum.cloudron.io/post/132082https://forum.cloudron.io/post/132082Thu, 29 Oct 2026 09:45:11 GMT<![CDATA[Reply to NodeJS CVE on Wed, 28 Oct 2026 18:14:14 GMT]]>The release is already rolling out as stable, but we just don't push it to all at once. For every Cloudron not part of the automatic update yet, it is shown as unstable with manual update path. So for the current case it seems maybe just a bit of a drastic warning.

]]>https://forum.cloudron.io/post/132050https://forum.cloudron.io/post/132050Wed, 28 Oct 2026 18:14:14 GMT<![CDATA[Reply to NodeJS CVE on Wed, 28 Oct 2026 18:12:22 GMT]]>@nebulon the only issue with this is that 10.1.6 is marked as pre-release.
Many (myself included) do not deploy pre-release to production servers.

With total respect to the fantastic work done by the Cloudron team on responding to the CVE crisis, the work is not complete until status of 10.1.6 is fully released.

]]>https://forum.cloudron.io/post/132049https://forum.cloudron.io/post/132049Wed, 28 Oct 2026 18:12:22 GMT<![CDATA[Reply to NodeJS CVE on Wed, 28 Oct 2026 17:39:41 GMT]]>We have already released updates for the nodejs base image and all apps using that to the fixed nodejs version v24.22.1

Further Cloudron 10.1.6 also has the nodejs version updated. So basically just make sure to update all apps and the Cloudron itself.

]]>https://forum.cloudron.io/post/132044https://forum.cloudron.io/post/132044Wed, 28 Oct 2026 17:39:41 GMT