20 lines
1.4 KiB
Markdown
20 lines
1.4 KiB
Markdown
# audiobookshelf — triage (group D)
|
|
Pin: ghcr.io/advplyr/audiobookshelf:2.37.1. Gates: setup_gate (public behind own login after the first admin).
|
|
|
|
## Notice: release:advplyr/audiobookshelf@v2.37.2 "October 2026 security release" — REAL, runtime only
|
|
Body of v2.37.2: "Docker image rebuilt with Node.js 24.22.1 (October 2026 security release)". The image is
|
|
FROM node:24-alpine (Node 24 since v2.37.0), so 2.37.1 carries a Node 24 older than 24.22.1 -> affected by the Oct 2026
|
|
Node CVEs (Brotli OOB write high; TLS hostname/DNS client issues).
|
|
- Reach in this app: no known path. express ^4 (body-parser 1.x inflates gzip/deflate only, not br); axios ^0.27.2
|
|
(no brotli). Other CVEs are client-side TLS/DNS: reached only when a logged-in user makes the server fetch
|
|
(podcast feed, metadata match). App code fixes in 2.37.2 are bug fixes; "Server init rejects creating a second root
|
|
user" is listed as internal hardening.
|
|
- Severity: high per Node; practical here: low (unsure: no audit of every fetch path). Login: any user for fetch paths.
|
|
Reachable: only via a logged-in user.
|
|
|
|
## Fix / target
|
|
Smallest fix = TARGET: `ghcr.io/advplyr/audiobookshelf:2.37.2` (ghcr tag exists; no `v`, matches pin). Same main: yes (2).
|
|
Breaking: none found (read 2.37.2). `ROUTER_BASE_PATH` normalization — not set in our compose.
|
|
Lane: SECURITY_FIX.
|
|
Classifier note: none (summary text "1 (October 2026 security release)" is a fragment but the hit is right).
|