This is a security release on top of 0.34.0. The docker images move from the pinned node:24.18.1-slim back to node:24-slim (currently Node 24.22.1) to pick up the October 2026 Node.js security releases. Among other fixes, these patch a Brotli decoder out-of-bounds write (CVE-2026-111497) and several TLS certificate hostname validation bypasses (CVE-2026-105483, CVE-2026-106069, CVE-2026-106072). Thanks @eriktews for the fix (#3217)!
The node version was pinned in 0.33.2 because of the better-sqlite3 crash loop (#2989). The upstream fix for that shipped in Node 24.22, so the pin is no longer needed.
Tracked CVEs
- CVE-2026-105483
- CVE-2026-106069
- CVE-2026-106072
- CVE-2026-111497
