LogicLabs-OU/OpenArchiver v0.6.2

v0.6.2: Node.js security rebuild (CVE-2026-111497)

on GitHub

This release rebuilds the Docker image on a Node.js version that fixes CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js. No application code changed between v0.6.1 and v0.6.2; the difference is the runtime inside the image.

It is recommended for all users to upgrade to the latest version of Open Archiver (v0.6.2) to include the security fix.

What happened

On 21 October 2026 the Node.js project published security releases 22.23.4, 24.22.1 and 26.12.1. One of the fixes closes a flaw in the bundled Brotli decoder: malformed compressed input could write past an internal buffer, which, known as CVE-2026-111497, can crash the process, disclose memory or allow remote code execution. Node.js decompresses Brotli whenever an application asks it to, and Open Archiver asks it to in two places:

• Incoming requests. Express decodes request bodies sent with Content-Encoding: br on every endpoint, including sign-in, and the web interface forwards request bodies to the API unchanged. An unauthenticated client on the web port could therefore reach the decoder.
• Outgoing requests. Mail fetched from Microsoft 365, Google Workspace and JMAP servers, text extraction through Tika, and the update check against GitHub all decompress Brotli responses when the server sends them.

The same flaw has since been reported in other software that bundles Google's Brotli decoder. The other services in the bundled compose file are not affected by it: PostgreSQL and Valkey do not decode Brotli, and Meilisearch and Apache Tika use their own Rust and Java implementations rather than the C library the advisory names. A reverse proxy or load balancer placed in front of Open Archiver is not part of this image; check its vendor's advisory separately.

How to upgrade

• Docker installs: Use the latest tag of Open Archiver in your Docker Compose file. Then pull and restart.

  docker compose pull
  docker compose up -d

• Installs that run from source: run Node.js 22.23.4, 24.22.1 or 26.12.1, or any newer release of those lines. Node.js 20, 23 and 25 are end of life and will not receive the fix.

Confirm with docker exec open-archiver node --version, which should print v22.23.4 or newer.

Build changes

• Each build pulls the node:22-alpine base image afresh instead of reusing a cached copy, so a rebuild always picks up the current patch release.

Full changelog: v0.6.1...v0.6.2