Rebuild release binaries on Bun ≥1.4.4 for CVE-2026-111497 (Brotli decoder RCE) #2405

Summary

The compiled Executor binaries are built with Bun 1.3.11, which bundles a Brotli decoder affected by CVE-2026-111497 (also called Node2Shell / HTTP2Shell): an out-of-bounds write in Google Brotli 1.0.3–1.2.0 that can be reached with attacker-controlled Brotli data. Bun's fetch() decompresses Content-Encoding: br responses automatically, so any server the daemon fetches from could send such a stream.

Bun fixed this in 1.4.4 (2026-10-22). Because the runtime is embedded by bun build --compile, the fix only reaches users once the binaries are rebuilt.

Evidence

• package.json pins "packageManager": "bun@1.3.11".
• The published executor@1.6.11-linux-x64 binary (latest as of 2026-10-26) still embeds bun-v1.3.11, as do older releases such as 1.5.20.
• Bun's Brotli pin (scripts/build/deps/brotli.ts):
  • bun-v1.3.11: BROTLI_COMMIT = "v1.1.0" (affected)
  • bun-v1.4.3: 028fb5a… (v1.2.0, affected)
  • bun-v1.4.4: db24a98… (v1.2.1, fixed)
• Upstream Brotli fixed releases: 1.0.10, 1.1.1, 1.2.1.

Ask

Bump packageManager (and the CI/release build) to Bun ≥ 1.4.4 and publish new platform binaries. Ideally the release notes would mention CVE-2026-111497, so people running the daemon know to update.

References

• Node.js security release (same bug): https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• Bun v1.4.4: https://bun.com/blog/bun-v1.4.4
• Tracker of bundled copies: https://phoenix.security/http2shell-expansion-cve-2026-111497-brotli-bundled-copies/

Thanks for Executor!