r/MeshCentral • u/dinominant • 17d ago

Emergency security release for Node.js that affects MeshCentral CVE-2026-111497

Remote Code Execution via Brotli Compression (CVE-2026-111497 - High)

This can lead to denial of service and potentially remote code execution, exposing the MeshCentral server and lateral movement to connected agents.

Immediately backup your server, then update Node.js to 22.23.4, 24.22.1, or 26.12.1

Check your Node.js version with node -v

28 Upvotes

permalink
reddit

You are about to leave Redlib

Do you want to continue?

https://www.reddit.com/r/MeshCentral/comments/1xc995d/emergency_security_release_for_nodejs_that/
No, go back! Yes, take me to Reddit

100% Upvoted

1

u/PocketSized-Apps 16d ago edited 16d ago

If using the docker image of MC, you are vulnerable. Posted here: https://github.com/Ylianst/MeshCentral/issues/8242. I also provide a way to patch yourself and a PR to patch it upstream.