# HTTP2Shell (CVE-2026-111497) — 2026-10-27 night, unattended after 22:40 CET

The Brotli decoder bug in Node.js (fixed 22.23.4 / 24.22.1 / 26.12.1; 20, 23, 25 get no fix) and Python `brotli`
(fixed 1.0.10 / 1.1.1 / 1.2.1) / `brotlicffi` (1.2.1.0). Sources read in the session: the CVE record via security
press (Brandefense, Aikido, SOCRadar, Phoenix Security), PYSEC-2026-4322/4323.

## What the images carry (read from the registries, `scripts/image_runtime.py`, no pull)

Checked against the live containers on demo-hp 9201 where one runs: Home Assistant 2026.9.4 Python Brotli 1.2.0 (live:
1.2.0), RomM 5.3.1 Node 24.18.1 (live: v24.18.1), Paperless 2.20.15 Brotli 1.1.0 (live: 1.1.0). The candidates: Home
Assistant 2026.10.4 Brotli **1.2.1**; RomM 5.4.1 (the newest) still Node 24.18.1; Immich v3.3.5 Node **24.22.1**.

**The whole catalog (the watch's filling run, `--no-mail`):** 20 catalog apps and one box program carry a bad runtime
(R-1332); DooPlex: 19 images to update (`HOMELAB-LIST.md`, R-1328). Positive controls named: Home Assistant, RomM;
negative control audiobookshelf 2.37.2 CURRENT.

## Steps (drill only — the live push waits for the operator)

- **Home Assistant 2026.9.4 → 2026.10.4**, a lane step (`09` §3 decision 276): `walks/home-assistant/` — proven on 9202
  through the guarded Update (135 s), the seeded owner logged in after, soak peak 30.6 % (anon), no kill, no restart;
  written to the drill (`3c8ebb5`, superseded step `steps/4f987bb4b035eef9.yml`).
- **Immich v3.2.4 → v3.3.5**, a lane step (R-1322): `walks/immich/` (see its walk.txt). 9202's old Immich was removed
  through the product first (its drive folder kept: the drive path could not be resolved — R-442, right).
- **Wanderer hidden** (D59): drill `ee18bff`; the live change is `wanderer-hidden.patch` (not committed to the live
  catalog at night).
- RomM: no fixed release exists (R-1330). Paperless: decodes only replies to its own outbound calls (R-1331).

## Decided by CC unattended (operator may reverse)

Home Assistant as a lane step (decision 276); the runtime cache filled on DooPlex with the stored Docker Hub login
instead of a zstd dependency in CI (08 §11); no Paperless step; RomM kept (pick in STATUS); the live catalog changes
kept as patches, not commits, at night.