Node-based images ship a Node.js vulnerable to Node2Shell (CVE-2026-111497); rebuild with --pull and republish the 3.0.x line

未关闭
  • 哪里不对？
#405 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
25/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
docker, nodejs
领域
devops

调研方向

The affected images are built from the FROM node:22-bookworm-slim and node:24-bookworm-slim lines in the mod/*/Dockerfile files. Check which base tags they use, then run docker run --rm --entrypoint node <image> --version on a rebuilt image. Done means the Node version is at or above 22.23.4 and 24.22.1, and the 3.0.x images are republished. Publishing needs maintainer access to Docker Hub, so this is not a good first contribution.

由索引模型根据 Issue 内容生成。

描述

Summary

The Node.js-based images built from this repo (mod/*/Dockerfile, FROM node:22-bookworm-slim / node:24-...) carry a Node.js below the versions that fix CVE-2026-111497 ("Node2Shell"), the out-of-bounds write in the bundled Google Brotli decoder. Node.js fixed it on 2026-10-21 in 22.23.4, 24.22.1 and 26.12.1 (https://nodejs.org/en/blog/vulnerability/october-2026-security-releases). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-10-27. Node.js offers no workaround; upgrading the runtime is the only remediation.

Because the Dockerfiles use floating base tags, the fix only reaches the published images when they are rebuilt with a fresh base. The images on Docker Hub were not, or were built from a stale cached base layer.

What the published images contain

Checked with docker run --rm --entrypoint node <image> --version on 2026-10-31:

Image Pushed Node inside Fixed version
alangecker/bbb-docker-graphql-actions:v3.0.39 2026-10-07 22.23.3 22.23.4
alangecker/bbb-shared-notes-server:v3.0.39 2026-10-07 22.23.3 22.23.4
alangecker/bbb-docker-bbb-export-annotations:v3.0.39 2026-10-07 22.23.3 22.23.4
alangecker/bbb-docker-webhooks:v3.6.0 2026-10-07 22.23.3 22.23.4
alangecker/bbb-docker-webrtc-sfu:v2.24.0 2026-10-07 22.23.3 22.23.4
alangecker/bbb-docker-pads:v1.5.8 2026-03-17 22.22.1 22.23.4
alangecker/bbb-docker-graphql-actions:v4.0.1 2026-10-30 24.22.0 24.22.1
alangecker/bbb-docker-webhooks:v3.7.0 2026-10-30 24.22.0 24.22.1

The 2026-10-30 builds are nine days after the fix and still one patch short, which points at Docker's layer cache resolving node:24-bookworm-slim to an old digest (no --pull).

Related, in another repo: bigbluebutton/greenlight:v3.9.0.1 (2026-09-09) contains Node 20.15.1. Node 20 is end of life and will never receive this fix. I can open a separate issue there if wanted.

Exposure

Whether a given service is exploitable depends on it decompressing attacker-supplied Brotli data (Node's HTTP server does not decode request bodies on its own). The runtime is nevertheless below the fixed version in every Node-based container of a standard deployment, which is what vulnerability scanners and the KEV listing act on, and operators cannot fix it without new images.

Request

  1. Rebuild and republish the Node-based images with a fresh base (docker build --pull, or pin the base, e.g. node:22.23.4-bookworm-slim / node:24.22.1-bookworm-slim): bbb-graphql-actions, bbb-shared-notes-server, bbb-export-annotations, webhooks, webrtc-sfu, bbb-pads.
  2. Please also republish the 3.0.x line (new v3.0.39 digests or a v3.0.40), since that is what the stable compose template deploys and a jump to the 4.0 images is a major upgrade for operators.
  3. Consider adding --pull to the image build workflow and a post-build check (node --version against the current security release) so a Node security release is picked up by the next build automatically.

Environment

  • bigbluebutton/docker at e59892e (2026-10-30), images as listed above
  • Host: Debian 13, Docker 29
主要语言
Shell
星标
436
派生
277
平均合并
3 天 14 小时
30 天内合并 PR
3

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

bigbluebutton/docker 的其他 Issue

查看 bigbluebutton/docker 的全部 Issue

相似的 Issue

更多 Shell/Bash Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。