<![CDATA[SECURITY: Immich and ReleaseBell packages still on Node 24.21.0 (CVE-2026-111497, Brotli)]]>@girish @nebulon the Immich and ReleaseBell packages still run Node v24.21.0, while other packages I checked already moved to 24.22.1 after the October Node security release.

Package Version Node of the running process
Immich 1.103.11 v24.21.0 (/usr/local/node-24.21.0/bin/node)
ReleaseBell 1.15.0 v24.21.0 (/usr/local/node/bin/node)

Why I think this matters:

  • CVE-2026-111497 (out-of-bounds write in the Brotli decoder) is fixed in Node 24.22.1 and was added to CISA KEV on 27-10.
  • Both apps ship body-parser 2.3.0, which handles Content-Encoding: br. On Immich I confirmed with a harmless compressed request that the login endpoint decompresses the body before authentication. ReleaseBell's body parser also runs before routing. I did not try the actual exploit, so I can't say whether it works on these builds.
  • The app access settings in Cloudron don't help here, as the request reaches the app without a login.

Could these two get a rebuild on the updated Node? It may also be worth checking whether other packages pin Node the same way.

]]>https://forum.cloudron.io/topic/16213/security-immich-and-releasebell-packages-still-on-node-24.21.0-cve-2026-111497-brotliRSS for NodeWed, 04 Nov 2026 05:35:19 GMTFri, 30 Oct 2026 07:35:50 GMT60<![CDATA[Reply to SECURITY: Immich and ReleaseBell packages still on Node 24.21.0 (CVE-2026-111497, Brotli) on Fri, 30 Oct 2026 17:18:18 GMT]]>@james thanks! Related: cloudron/php-base:8.5-20261021 and the current WordPress package (3.17.1) still ship libbrotli1 1.2.0-3build1, while the Ubuntu fix for CVE-2026-111497 is 1.2.0-3ubuntu0.1. PHP apps reach this through libcurl, as WordPress decodes Brotli on outbound requests (see Patchstack's write-up, https://patchstack.com/articles/wordpress-doesnt-ship-brotli-its-still-exposed-to-cve-2026-111497/). Could the PHP base get a rebuild as well?

]]>https://forum.cloudron.io/post/132146https://forum.cloudron.io/post/132146Fri, 30 Oct 2026 17:18:18 GMT<![CDATA[Reply to SECURITY: Immich and ReleaseBell packages still on Node 24.21.0 (CVE-2026-111497, Brotli) on Fri, 30 Oct 2026 08:34:56 GMT]]>Hello @imc67
We are aware and are already working on it.

]]>https://forum.cloudron.io/post/132114https://forum.cloudron.io/post/132114Fri, 30 Oct 2026 08:34:56 GMT