1.5 KiB
1.5 KiB
docmost — triage (group D)
Pins: docmost/docmost:0.96.0, postgres:18-alpine, redis:7-alpine (no notices). Gates: setup_gate.
Notice: release:docmost/docmost@v0.97.0 "security fixes for the latest Node" — REAL, runtime + dependencies
- Image is FROM node:26-slim (since 0.96.0); Oct 21 2026 Node release fixes 26.x (Brotli high, TLS/DNS, ZipFile).
- PR #2567 "update packages with security advisories": fastify 5.12.5, @fastify/multipart 10.1.2, socket.io 4.8.4, @nestjs/* 11.2.7, MCP sdk 1.32.1, dompurify 3.4.16, proxy-addr, engine.io, handlebars re-resolved. Upstream names no CVE ids; fastify/socket.io/multipart are pre-auth surfaces, specific exploitability unknown.
- Docmost's own GHSAs (18 listed via the repo API): all patched at <= 0.95.0 — none affects 0.96.0.
- Severity: unsure (no app advisory; Node CVE high). Login: unsure (pre-auth surfaces involved). Reachable: yes after the setup gate opens (public behind own login; public share pages exist).
Fix / target
Smallest fix = TARGET: docmost/docmost:0.97.0 (Docker Hub, 2026-10-25; no v, matches pin). Same main: yes (0).
Breaking: none found (read v0.97.0 full PR list). Note PR #2580: client IP now resolved through trusted proxies
(replaces fastify-ip; CF-Connecting-IP only from Cloudflare edge hops) — our template strips X-Forwarded-For (R-753);
re-check rate-limit IP on the box walk. PR #2596: API page content format defaults to json. New integrations are opt-in.
Lane: SECURITY_FIX.
Classifier note: none.