20 lines
1.5 KiB
Markdown
20 lines
1.5 KiB
Markdown
# docmost — triage (group D)
|
|
Pins: docmost/docmost:0.96.0, postgres:18-alpine, redis:7-alpine (no notices). Gates: setup_gate.
|
|
|
|
## Notice: release:docmost/docmost@v0.97.0 "security fixes for the latest Node" — REAL, runtime + dependencies
|
|
- Image is FROM node:26-slim (since 0.96.0); Oct 21 2026 Node release fixes 26.x (Brotli high, TLS/DNS, ZipFile).
|
|
- PR #2567 "update packages with security advisories": fastify 5.12.5, @fastify/multipart 10.1.2, socket.io 4.8.4,
|
|
@nestjs/* 11.2.7, MCP sdk 1.32.1, dompurify 3.4.16, proxy-addr, engine.io, handlebars re-resolved. Upstream names no
|
|
CVE ids; fastify/socket.io/multipart are pre-auth surfaces, specific exploitability unknown.
|
|
- Docmost's own GHSAs (18 listed via the repo API): all patched at <= 0.95.0 — none affects 0.96.0.
|
|
- Severity: unsure (no app advisory; Node CVE high). Login: unsure (pre-auth surfaces involved). Reachable: yes after
|
|
the setup gate opens (public behind own login; public share pages exist).
|
|
|
|
## Fix / target
|
|
Smallest fix = TARGET: `docmost/docmost:0.97.0` (Docker Hub, 2026-10-25; no `v`, matches pin). Same main: yes (0).
|
|
Breaking: none found (read v0.97.0 full PR list). Note PR #2580: client IP now resolved through trusted proxies
|
|
(replaces fastify-ip; CF-Connecting-IP only from Cloudflare edge hops) — our template strips X-Forwarded-For (R-753);
|
|
re-check rate-limit IP on the box walk. PR #2596: API page content format defaults to json. New integrations are opt-in.
|
|
Lane: SECURITY_FIX.
|
|
Classifier note: none.
|