All, You may have seen the recent announcement of CVE-2026-111497 <https://app.opencve.io/cve/CVE-2026-111497> (also known as Node2Shell). This is a CRITICAL vulnerability in the Brotli decoder used by Node.js.
*As the DSpace user interface runs on Node.js and uses Brotli, we HIGHLY RECOMMEND upgrading Node.js immediately in order to patch your system.* The patched versions of Node.js include v22.23.4, v24.22.1, and v26.12.1. Please upgrade to one of these releases for your DSpace frontend. Additional Resources: * https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#security-releases-available * https://www.securityweek.com/node2shell-brotli-flaw-triggers-patching-across-microsoft-node-js-python-packages/ * https://github.com/advisories/GHSA-9v8h-qqgm-4m35 If you have any questions about this vulnerability, please email [email protected]. This email address sends a private email to all DSpace Committers. Sincerely, Tim Donohue, on behalf of the DSpace Committers -- All messages to this mailing list should adhere to the Code of Conduct: https://lyrasis.org/code-of-conduct/ --- You received this message because you are subscribed to the Google Groups "DSpace Technical Support" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/dspace-tech/d7b58992-39d5-45b6-9298-2600bb82cd04n%40googlegroups.com.
