NodeJS CVE
-
Should we be worried / taking steps?
https://www.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce
-
-
We have already released updates for the nodejs base image and all apps using that to the fixed nodejs version v24.22.1
Further Cloudron 10.1.6 also has the nodejs version updated. So basically just make sure to update all apps and the Cloudron itself.
@nebulon the only issue with this is that 10.1.6 is marked as pre-release.
Many (myself included) do not deploy pre-release to production servers.With total respect to the fantastic work done by the Cloudron team on responding to the CVE crisis, the work is not complete until status of 10.1.6 is fully released.
-
The release is already rolling out as stable, but we just don't push it to all at once. For every Cloudron not part of the automatic update yet, it is shown as unstable with manual update path. So for the current case it seems maybe just a bit of a drastic warning.
-
@nebulon sorry to jump in here.
CVE-2026-111497 is not just about NodeJS ( that node2shell name isn't great) but potentially anything using the same brotli decoder.
i.e. this page https://broccoli2shell.com/ gives an overview of software embedding libbrotli copy (similar as the 'fun' we had recently with the embedded ca-certs)Looking at the 6.0.1 base-image it doesn't contain the libbrotli1 version with the Ubuntu fix yet (1.2.0-3ubuntu0.1) as that came just a few days later only
Looking what points to it (apt-rdepends)- apache2 (php container, but maybe less critical given the nginx as proxy on the host)
- curl
- non-http things (libwoff1, jxl (maybe via ffmpeg)
That's not a full or verified list just a first look.
Note: I'm also not shouting critical here just writing as above only talked about NodeJS angle.Do you plan to bump the base image again for this?
Otherwise are the any plans to do that periodically to catch up to accumulated fixes which don't warrant the overhead of some immediate action?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login