Description
Hello Rocket.Chat team,
We are running Rocket.Chat Community Edition in a Docker environment and would like to clarify whether our deployment is affected by CVE-2026-111497, a Node.js security vulnerability.
We would appreciate your guidance on the availability of a patched Docker image and the recommended mitigation for users who need to remain on the 8.5.x release line.
Environment details
Version of Rocket.Chat Server: 8.5.3 Community
Operating System: Ubuntu
Deployment Method: Docker
Number of Running Instances: T1
DB Replicaset Oplog: Yes — MongoDB replica set with oplog enabled.
NodeJS Version: 22.23.3
MongoDB Version: 8.2.12 / wiredTiger
Questions
Is Rocket.Chat 8.5.3 Community affected by CVE-2026-111497?
Is a patched Docker image planned for the 8.5.x release line, including Node.js 22.23.4 or a later patched version?
If no patched image is available, what mitigation do you recommend for Community Edition deployments?
Is upgrading Node.js independently within the existing Rocket.Chat Docker image supported, or could this cause application compatibility issues?
Is upgrading to a newer Rocket.Chat release the recommended solution?
We would prefer to remain on the 8.5.x release line if possible, and we would appreciate any official guidance on the safest upgrade or mitigation path.
Thank you for your help.
Server Setup Information
- Version of Rocket.Chat Server:
- Operating System:
- Deployment Method:
- Number of Running Instances:
- DB Replicaset Oplog:
- NodeJS Version:
- MongoDB Version:
- Proxy:
- Firewalls involved: