Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Security] Update Node.js to 24.22.1+ to fix CVE-2026-111497 (Brotli decoder RCE)

Open
  • Is something wrong?
#2,324 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

@lucamzanon is already working on this.

Since Oct 23, 2026.

  • #2325 by @lucamzanon — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
docker, node.js, typescript
Domain
devops, release, security

Research direction

Start by locating the Docker build definitions for the WEBJS, NOWEB, and GOWS images and their ARM variants, then check how the Node.js base image version is pinned. Rebuild and publish each variant with Node.js 24.22.1 or later; verify the published images report the patched Node.js version.

Written by the indexing model from the issue text.

Description

Summary

Please publish new WAHA images built on a patched Node.js release to address CVE-2026-111497 (High): an out-of-bounds write in the Brotli decoder that permits remote code execution.

The same release also fixes several other High issues (TLS hostname-check bypasses CVE-2026-105483 / CVE-2026-106069, dns.resolve NUL truncation CVE-2026-105482) and updates OpenSSL, c-ares and Undici.

Current state

The latest published image, devlikeapro/waha:gows-2026.9.2 (sha256:1ae3c6a994ee97e5039bf41103193d7bf9175f1a31db73ba89bdeed6277901bc, released 2026-10-02), ships Node.js v24.11.1:

$ docker run --rm --entrypoint node devlikeapro/waha:gows-2026.9.2 -v
v24.11.1

The patched base images are already available on Docker Hub: node:24.22.1-bookworm and node:24.22.1-bookworm-slim.

Request

Could you rebuild and publish all variants (WEBJS, NOWEB, GOWS, including -arm) on Node.js 24.22.1 or later? A patch release would be much appreciated, since users who pin by digest can't pick up the fix until a new tag is out.

Thanks for maintaining WAHA!

Dominant language
TypeScript
Stars
7.6k
Forks
1.8k
Avg merge
2d 21h
Merged PRs (30d)
7

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from devlikeapro/waha

All issues in devlikeapro/waha

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.