A new security vulnerability has been discovered in the brotli library, which implements a compression algorithm used by several programming languages and software projects, including NodeJS. The vulnerability has been assigned CVE-2026-111497 and affects multiple versions of the brotli library. We recommend updating all affected software to the latest versions that include the security fix.
The vulnerability was fixed in NodeJS 24.22.1, released on October 21, 2026.
The good news: openITCOCKPIT 5.9.0 is not affected by this vulnerability. It was built and released on October 22, 2026, and already includes NodeJS 24.22.1 with the security fix.
How can I check if my system is affected?
If you are using openITCOCKPIT 5.9.0 or later, your system should already include the patched version. To verify this, run the following command:
docker exec -it openitcockpit-node node --version
The output should show v24.22.1 or later, indicating that your system includes the patched version of NodeJS.
For example:
[Ubuntu][08:47]root@openitcockpit-node~# docker exec -it openitcockpit-node node --version
v24.22.1
If you see an older version, update your openITCOCKPIT installation. If this does not resolve the issue, please contact us immediately.
If you are running the Docker version of openITCOCKPIT, first run docker ps to identify the Puppeteer container. Its name should be similar to openitcockpit-ce-docker-puppeteer-1.
Then check the NodeJS version inside the container by running:
docker exec -it openitcockpit-ce-docker-puppeteer-1 node --version
The output should also show v24.22.1 or later, confirming that the container includes a patched version of NodeJS.
Why is NodeJS part of openITCOCKPIT?
openITCOCKPIT uses a tool called Puppeteer to generate PDF files. Puppeteer requires NodeJS to run. openITCOCKPIT does not install NodeJS directly on the host system.
Instead, it ships a Docker container (openitcockpit-node) that includes NodeJS and all the dependencies needed to run Puppeteer.
The openitcockpit-node container listens only on 127.0.0.1:7084, so it is not reachable from outside the openITCOCKPIT server itself.
How to update
To ensure that apt replaces and upgrades all packages correctly, use apt-get dist-upgrade.
Please see the official documentation for instructions on how to update openITCOCKPIT.
Refresh your monitoring configuration
After updating openITCOCKPIT, we recommend refreshing your monitoring configuration to ensure that all changes are applied correctly.
Your openITCOCKPIT Team