Rebuild and publish postgres-meta to patch Node.js Brotli vulnerability (CVE-2026-111497)

Open Beginner friendly
  • Is something wrong?
#1,173 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
73/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
docker, node.js, typescript
Domain
backend, devops

Research direction

Start by locating the Docker build and release configuration for the meta image, then check how its Node.js version is selected. Rebuild and publish the image with Node.js 22.23.4 or later; verify it with the issue’s Docker command and confirm it reports the patched runtime.

Written by the indexing model from the issue text.

Description

bug

Bug report

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

The latest docker image supabase/postgres-meta:v0.100.0 (which is used by self-hosted/v0.8.3) is built prior to the October 21, 2026 Node.js security patch for CVE-2026-111497 (Critical CVSS 9.2 Brotli libbrotlidec out-of-bounds heap write / RCE affecting Node.js < 22.23.4 and < 24.22.1).

supabase/postgres-meta:v0.100.0 does not yet have a rebuilt image tag with Node.js 22.23.4.

To Reproduce

Steps to reproduce the behavior:

  1. Pull the latest image:
docker pull supabase/postgres-meta:v0.100.0
  1. Check the containers for the Node.js CVE-2026-111497 patch constant (zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH === -17):
docker run --rm supabase/postgres-meta:v0.100.0 node -p "zlib.constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH === -17 ? 'PATCHED' : 'VULNERABLE (' + process.version + ')'"
  1. See output confirming unpatched runtimes:
VULNERABLE (v22.23.3)

Expected behavior

  1. Rebuild and publish a new supabase/postgres-meta release using Node.js >= 22.23.4.
PATCHED (v22.23.4)

System information

  • OS: Linux (Docker self-hosted)
  • Version of Node.js inside containers:
  • supabase-meta (v0.100.0): v22.23.3
Dominant language
TypeScript
Stars
1.3k
Forks
228
Avg merge
1d 8h
Merged PRs (30d)
3

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/postgres-meta

All issues in supabase/postgres-meta

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.