Repository navigation
Fix CVE-2026-111497 (Brotli RCE) #2198
Description
The 2.7.x and 3.0.x images are affected by CVE-2026-111497 (CISA KEV).
I fixed this by updating the versions:
- Node 20 → 22.23.4, pinned (26.12.1 for hocuspocus)
- nginx 1.27.1 → 1.30.6
Patched images for testing are available at the gitlab container registry, tagged 2.7.6_hotfix.1 and 3.0.0_hotfix.1.
Branches:
Activity
cedric-mertig commentedon Nov 1, 2026
As discussed with the team, I opened a pr to dev for both versions under
#2200
#2201
This might become a v.2.7.7 and 3.0.1 respectively instead of a hotfix.