felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/code-server.md

code-server — triage (group D)

Pin: lscr.io/linuxserver/code-server:4.129.0. Gates: none (code-server's own PASSWORD login is the only door).

Notice: release:coder/code-server@v4.141.1 "Brotli decoder (CVE-2026-111497)" — REAL (bundled Node.js runtime + code-server change)

• It is a Node.js bug (Node Oct 21 2026 security release: Brotli decoder OOB write -> RCE, high; affects 22.x/24.x/26.x). code-server ships its own Node in the release tarball; linuxserver's Dockerfile installs that tarball, so the image's Node is code-server's. .node-version: v4.129.0 = 24.18.0 (affected), v4.141.1 and v4.143.1 = 24.22.1 (fixed).
• code-server itself also changed: "Reject compressed request bodies (br/gzip/deflate) instead of decompressing them" (commit range touches routes/index.ts + login.test.ts). code-server uses express ^5 (body-parser 2 inflates br), so a stranger's POST to /login with Content-Encoding: br reached the vulnerable decoder BEFORE authentication.
• Severity: high (RCE). Login: none (pre-auth path via body parsing — strongly indicated by the fix, not tested live). Reachable: yes, public subdomain, no gate.

Fix / target

Smallest fix: 4.141.1 (linuxserver tag 4.141.1 exists, 2026-10-23). Newest stable: v4.143.1 (after 4.141.1 in CHANGELOG.md, same Node 24.22.1). TARGET: lscr.io/linuxserver/code-server:4.143.1 (exists, 2026-10-24, = 4.143.1-ls373). Same main: yes (4). Read all 16 releases 4.130.0..4.143.1:

• no data/file migration, no removed config, no new service. Behaviour changes: --flag=false in config now honoured (4.141.1); compressed request bodies refused (4.141.1); proxy cookies passed unchanged (4.132.0); --unsafe-perm removed from npm install scripts (4.134.0, not used by the image); 4.136.1 was withdrawn (data path bug) — skip it.
• VS Code core 1.129 -> 1.143 (14 upstream releases): extension compatibility is the main practical risk; not a breaking change in the brief's sense. linuxserver: 20.09.26 IPv6 fallback only. Lane: SECURITY_FIX (large gap; recommend the box walk opens a terminal + an extension after the move). Classifier note: none (correct hit).