[Bug]: Docker images for v1.64.1 ship Node.js 24.21.0, which is affected by CVE-2026-111497
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 70/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- docker, node.js, typescript
Research direction
The report identifies Docker images tagged v1.64.1 and says their Dockerfiles use ARG NODE_VERSION=24; start by reading those Dockerfiles and the image build and publish entry point. Run the provided docker run command and check node --version and dpkg-query -W nodejs. Done means the rebuilt and republished tags contain a fixed Node.js 24 release.
Written by the indexing model from the issue text.
Description
Version
1.64.1
Steps to reproduce
docker run --rm mcr.microsoft.com/playwright:v1.64.1-noble sh -c 'node --version; dpkg-query -W nodejs'
Same result on linux/amd64 and linux/arm64.
Expected behavior
The current v1.64.1 images ship a Node.js release with the fix for CVE-2026-111497 (out-of-bounds write in the bundled Brotli decoder). The fixed releases are 22.23.4, 24.22.1 and 26.12.1 (October 2026 security releases).
Actual behavior
v24.21.0
nodejs 24.21.0-1nodesource1
The image was built on 2026-10-14, before the Node.js fix.
Additional context
No code change is needed. The Dockerfiles set ARG NODE_VERSION=24 and install the latest 24.x from NodeSource during the build, and NodeSource now serves 24.22.1-1nodesource1. A rebuild and republish of the v1.64.1 tags (-noble, -jammy, -resolute, and v1.64.1) would pick up the fix.
Inside the image, the Brotli decoder runs on responses that Playwright fetches: APIRequestContext decodes Content-Encoding: br bodies with zlib.createBrotliDecompress (packages/playwright-core/src/server/fetch.ts). Node's own fetch() also decodes br responses automatically.
Environment
mcr.microsoft.com/playwright:v1.64.1-noble (created 2026-10-14T12:22:06Z)
Node: 24.21.0 (nodejs 24.21.0-1nodesource1)
- Dominant language
- TypeScript
- Stars
- 98k
- Forks
- 6.6k
- Avg merge
- 15h 59m
- Merged PRs (30d)
- 296
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/playwright
-
[Bug]: `playwright install` hangs silently for ~8 minutes when PLAYWRIGHT_BROWSERS_PATH is not writablePossibly taken @dcrousso claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
microsoft/playwright#43606 ·
Maintainers usually reply within 1 day
-
[Feature]: Set `this.name` in `TargetClosedError` constructorMay be free again @LeonxLJX claimed this 50 days ago, and no pull request is open. OpenP3-collecting-feedback
Difficulty 1/5 Under an hour Newbie friendliness 86/100
microsoft/playwright#42522 · 7 comments ·
Maintainers usually reply within 1 day
-
[Bug]: addLocatorHandler() appears to intercept its own action during expect().toPass() retriesPossibly taken @dcrousso claimed this today. Openneeds-triage-mac
Difficulty 4/5 3-5 days Newbie friendliness 45/100
microsoft/playwright#43607 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 4/5 3-5 days Newbie friendliness 42/100
microsoft/playwright#43602 · 1 comment ·
Maintainers usually reply within 1 day
-
[Bug]: On Windows, parallel runs that share the transform cache fail to load a test file with EPERMPossibly taken @microsoft-playwright-automation claimed this today. Openneeds-triage-win
Difficulty 3/5 1-2 days Newbie friendliness 58/100
microsoft/playwright#43601 · 2 comments ·
Maintainers usually reply within 1 day
All issues in microsoft/playwright
Similar issues
-
[Bug]: REST API URL starting with "http" but no scheme (e.g. httpbin.org/get) is not given an http:// prefixPossibly taken @ItsDeadlyProgrammer claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
appsmithorg/appsmith#42471 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
ehmpathy/rhachet-roles-bhrain#705 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Status: Triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
mermaid-js/mermaid#8546 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
braintrustdata/braintrust-sdk-javascript#2659 ·
Maintainers usually reply within 1 day