Repository navigation
[Security] Patch Node.js 24 for October 2026 CVEs (Brotli RCE) #2761
Description
Summary
The October 21, 2026 Node.js security release addresses several high-severity issues, including CVE-2026-111497 (Brotli decoder out-of-bounds write / potential RCE). The patched Node.js 24 LTS release is v24.22.1.
Evolution API's Dockerfile uses node:24-alpine in both builder and runtime stages. Previously published images don't receive patched Node.js automatically when the upstream base changes.
Potential exposure
- The Baileys media handling service downloads external URLs with
axios.get(). - The lockfile resolves
axios@1.13.2, whose Node HTTP adapter supports Brotli decompression (zlib.createBrotliDecompress()). - An attacker-controlled Brotli HTTP response reaching this code path could potentially exercise the vulnerable decoder. This is a possible reachability path, not a demonstrated exploit or an unauthenticated RCE in Evolution API.
Requested fix
- Rebuild both Docker stages on Node.js 24.22.1 or newer patched 24.x, using a specific patched tag/digest.
- Publish and verify
linux/amd64andlinux/arm64images (reportnode -v). - Document affected image versions/digests and operator update steps; an ordinary
docker compose pullis insufficient until patched images exist. - Regression-test startup, WhatsApp pairing, media handling and webhooks.
- Independently audit locked npm dependencies.
Suggested priority: High; patch promptly, particularly where the application fetches externally controlled URLs.
References
- https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
- https://nodejs.org/en/blog/release/v24.22.1
- https://github.com/evolution-foundation/evolution-api/blob/main/Dockerfile
- https://github.com/evolution-foundation/evolution-api/blob/main/src/api/integrations/channel/whatsapp/whatsapp.baileys.service.ts
- https://github.com/axios/axios/blob/v1.13.2/lib/adapters/http.js
Activity
fix(docker): pin Node.js to patched 24.22.1 for October 2026 CVEs
ci: run code quality checks on Node.js 24
build(docker): pin the Node.js base image to 24.22.1 by digest
build(docker): pin the Node.js base image to 24.22.1 by digest
cristhianohenri83-source commentedon Oct 26, 2026
Following up on #2761 and #2765: we need an official patched linux/amd64 image for the deployment path n8n → Evolution API → official WhatsApp Business Cloud API (Meta). We will not use Baileys, WhatsApp Web, QR pairing or a custom fork as a substitute.
Our OCI metadata inspection on 2026-10-26 found these
NODE_VERSIONvalues forevoapicloud/evolution-api:v2.3.7:24.11.1, amd64 digestsha256:456b4104b0ddffbb092d6b3c0560a4ae86fc3e014e885b882aca4b1b371dfc81.latest:24.15.0, amd64 digestsha256:e15508de128b9ab232d9cabb2441ca897a4802fba2c8186ed384b4f4508767d9.2.4.0-rc1and2.4.0-rc2:24.15.0in the inspected metadata.We did not execute those images. These are OCI metadata observations, not
node -vresults or a demonstrated exploit. At this readback, #2765 is still open/unmerged; a proposed base-image change alone is not evidence that a corrected Evolution image has been published.Could maintainers please provide:
If the licensing/activation questions belong in a separate official support channel, please point us there. This request does not accept terms, subscribe to a service or authorize a purchase. No private configuration, business data, server addresses, logs or credentials are included.
Reference: https://nodejs.org/en/blog/release/v24.22.1