Security app updates, Part 1: the triage of 38 flagged pins (TRIAGE.md, per-app notes, PICKS.md); R-1306 triaged; R-1310 (watch classifier) and R-1311 (Termix X-Forwarded-For) filed

documentation/audits/security-app-updates-2026-10-27/triage-notes/code-server.md

@@ -0,0 +1,24 @@
+# code-server — triage (group D)
+Pin: lscr.io/linuxserver/code-server:4.129.0. Gates: none (code-server's own PASSWORD login is the only door).
+
+## Notice: release:coder/code-server@v4.141.1 "Brotli decoder (CVE-2026-111497)" — REAL (bundled Node.js runtime + code-server change)
+- It is a Node.js bug (Node Oct 21 2026 security release: Brotli decoder OOB write -> RCE, high; affects 22.x/24.x/26.x).
+  code-server ships its own Node in the release tarball; linuxserver's Dockerfile installs that tarball, so the image's
+  Node is code-server's. `.node-version`: v4.129.0 = 24.18.0 (affected), v4.141.1 and v4.143.1 = 24.22.1 (fixed).
+- code-server itself also changed: "Reject compressed request bodies (br/gzip/deflate) instead of decompressing them"
+  (commit range touches routes/index.ts + login.test.ts). code-server uses express ^5 (body-parser 2 inflates br),
+  so a stranger's POST to /login with `Content-Encoding: br` reached the vulnerable decoder BEFORE authentication.
+- Severity: high (RCE). Login: none (pre-auth path via body parsing — strongly indicated by the fix, not tested live).
+  Reachable: yes, public subdomain, no gate.
+
+## Fix / target
+Smallest fix: 4.141.1 (linuxserver tag `4.141.1` exists, 2026-10-23). Newest stable: v4.143.1 (after 4.141.1 in
+CHANGELOG.md, same Node 24.22.1). TARGET: `lscr.io/linuxserver/code-server:4.143.1` (exists, 2026-10-24, = 4.143.1-ls373).
+Same main: yes (4). Read all 16 releases 4.130.0..4.143.1:
+- no data/file migration, no removed config, no new service. Behaviour changes: `--flag=false` in config now honoured
+  (4.141.1); compressed request bodies refused (4.141.1); proxy cookies passed unchanged (4.132.0); `--unsafe-perm`
+  removed from npm install scripts (4.134.0, not used by the image); 4.136.1 was withdrawn (data path bug) — skip it.
+- VS Code core 1.129 -> 1.143 (14 upstream releases): extension compatibility is the main practical risk; not a breaking
+  change in the brief's sense. linuxserver: 20.09.26 IPv6 fallback only.
+Lane: SECURITY_FIX (large gap; recommend the box walk opens a terminal + an extension after the move).
+Classifier note: none (correct hit).