1.4 KiB
1.4 KiB
audiobookshelf — triage (group D)
Pin: ghcr.io/advplyr/audiobookshelf:2.37.1. Gates: setup_gate (public behind own login after the first admin).
Notice: release:advplyr/audiobookshelf@v2.37.2 "October 2026 security release" — REAL, runtime only
Body of v2.37.2: "Docker image rebuilt with Node.js 24.22.1 (October 2026 security release)". The image is FROM node:24-alpine (Node 24 since v2.37.0), so 2.37.1 carries a Node 24 older than 24.22.1 -> affected by the Oct 2026 Node CVEs (Brotli OOB write high; TLS hostname/DNS client issues).
- Reach in this app: no known path. express ^4 (body-parser 1.x inflates gzip/deflate only, not br); axios ^0.27.2 (no brotli). Other CVEs are client-side TLS/DNS: reached only when a logged-in user makes the server fetch (podcast feed, metadata match). App code fixes in 2.37.2 are bug fixes; "Server init rejects creating a second root user" is listed as internal hardening.
- Severity: high per Node; practical here: low (unsure: no audit of every fetch path). Login: any user for fetch paths. Reachable: only via a logged-in user.
Fix / target
Smallest fix = TARGET: ghcr.io/advplyr/audiobookshelf:2.37.2 (ghcr tag exists; no v, matches pin). Same main: yes (2).
Breaking: none found (read 2.37.2). ROUTER_BASE_PATH normalization — not set in our compose.
Lane: SECURITY_FIX.
Classifier note: none (summary text "1 (October 2026 security release)" is a fragment but the hit is right).