[mahfuz-rahman007]

I run the official 3.9.0 image, and the Node.js it ships is 25.9.0. That build is affected by CVE-2026-111497, a vulnerability in Node's Brotli decoder that can lead to remote code execution, fixed on 21 October 2026 in Node 22.23.4, 24.22.1, and 26.12.1 (https://nodejs.org/en/blog/vulnerability). Node 14, 16, 18, 19, 20, 21, 23, and 25 are end of life and will not get this patch, so the runtime needs to be on 22.23.4, 24.22.1, or 26.12.1. In Dockerfile, the image is still based on node:25-alpine. Updating both build stages to node:26.12.1-alpine and publishing a new release would ship a patched runtime. The patch below is only that version bump.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[ToddyTheNoobDud]

Suggested change

	FROM node:24.22.1-alpine
	FROM node:26-alpine

By the way, since nodejs 26 is the next LTS scheduled (ends in 2029), I think it would be better to go with 26, comparing with node 24 it brings better memory efficiency and some upgrades in op/s for JSON which we use.

I din't find any issue running nodelink + node 26 (i use 26 since the release), so it should not be a problem bumping it 🙏

[mahfuz-rahman007]

Thanks @ToddyTheNoobDud, good point on 26. Updated both stages of the Dockerfile to node:26.12.1-alpine (the fixed 26 release; the builder stage was still on 25, and node_modules are copied from it, so both should match). I pinned the exact version rather than the floating 26-alpine so the image stays on a patched release, but happy to switch to 26-alpine if you prefer.

[ToddyTheNoobDud]

Please let it be

FROM node:26-alpine

because this way it'll get the latest node 26 version whenever the image is rebuilt/pulled, and pinning it to a specific version is not that good imo, cuz more CVEs/security issues can appear later and we would need to manually update it every time.