{
  "_comment": [
    "The runtime table of the security watch (R-1327): runtime parts that ship INSIDE an app or box image and have",
    "their own security notices, which the app's notices never repeat. One row per part. `fixed` maps a release LINE",
    "(the leading numbers, as many as the row's `line_parts`) to the first fixed version on that line; a line below the",
    "highest listed line that has no entry is END OF LIFE (no fix will come — the advisory says so); a line above it",
    "is newer than the notice and not affected. `from` is the first affected version. `groups` limits a row to some pin",
    "groups (the OS packages: our own box/build images only — R-1307's scope; for apps the image's own runtime rows",
    "apply). Facts of 2026-10-27, CVE-2026-111497 (HTTP2Shell / Node2Shell), from the CVE record, the Node.js security",
    "release of 2026-10-21 and PYSEC-2026-4322/4323 — read in the session, sources in the night report."
  ],
  "rows": [
    {"part": "node", "label": "Node.js", "id": "CVE-2026-111497", "severity": "critical", "line_parts": 1,
     "from": "0", "fixed": {"22": "22.23.4", "24": "24.22.1", "26": "26.12.1"},
     "summary": "Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process",
     "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"},
    {"part": "brotli", "label": "Python Brotli", "id": "CVE-2026-111497", "severity": "critical", "line_parts": 2,
     "from": "1.0.3", "fixed": {"1.0": "1.0.10", "1.1": "1.1.1", "1.2": "1.2.1"},
     "summary": "Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4322",
     "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"},
    {"part": "brotlicffi", "label": "Python brotlicffi", "id": "CVE-2026-111497", "severity": "critical", "line_parts": 2,
     "from": "0", "fixed": {"1.2": "1.2.1.0"},
     "summary": "Brotli decoder out-of-bounds write (HTTP2Shell), PYSEC-2026-4323",
     "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"},
    {"part": "apk:brotli-libs", "label": "Alpine brotli-libs", "id": "CVE-2026-111497", "severity": "critical",
     "line_parts": 2, "from": "1.0.3", "fixed": {"1.0": "1.0.10", "1.1": "1.1.1", "1.2": "1.2.1"},
     "groups": ["box", "build"],
     "summary": "the Brotli library of the image's Alpine base (HTTP2Shell)",
     "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "published": "2026-10-21"}
  ]
}