v0.106.1
Important
This is a security release for the server and Docker images. If you run Trilium as a server, especially one reachable from the internet, update as soon as possible.
🔒 Security
- Updated Node.js in the Docker images to 24.22.1 (22.23.4 for the legacy image), taking in the Node.js security releases of 21 October 2026:
- Brotli decoder out-of-bounds write (CVE-2026-111497). Trilium decompresses Brotli-encoded request bodies before authentication, so on earlier versions any client that could reach the server could send a malicious request. Outbound requests (link previews, image downloads, web search) were also affected through the responses they receive.
- Revoked eMudhra/emSign certificate authorities. The certificate store bundled with Node.js trusted certificate authorities whose keys were compromised. This allowed a man-in-the-middle with the right network access to impersonate HTTPS servers that Trilium connects to (sync with another instance, link previews, LLM providers).
- Other fixes to TLS, HTTP and DNS handling from the same Node.js release.
Tip
If you enjoyed this release, consider showing a token of appreciation by:
- Pressing the “Star” button on GitHub (top-right).
- Considering a one-time or recurrent donation to the lead developer via GitHub Sponsors or PayPal.