# CVE-2026-111497 — Node.js security vulnerability in Rocket.Chat 8.5.3 Community **URL:** \ **Category:** Community Support\ **Created:** [October 23, 2026, 9:43pm UTC](https://forums.rocket.chat/t/cve-2026-111497-node-js-security-vulnerability-in-rocket-chat-8-5-3-community/23042 "2026-10-23T21:43:52Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![adrianavrodrigues](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/adrianavrodrigues/32/4666_2.png) [@adrianavrodrigues](https://forums.rocket.chat/u/adrianavrodrigues)\ **Post date:** [October 23, 2026, 9:43pm UTC](https://forums.rocket.chat/t/cve-2026-111497-node-js-security-vulnerability-in-rocket-chat-8-5-3-community/23042/1 "2026-10-23T21:43:52Z")
### Description Hello Rocket.Chat team, We are running Rocket.Chat Community Edition in a Docker environment and would like to clarify whether our deployment is affected by CVE-2026-111497, a Node.js security vulnerability. We would appreciate your guidance on the availability of a patched Docker image and the recommended mitigation for users who need to remain on the 8.5.x release line. Environment details Version of Rocket.Chat Server: 8.5.3 Community Operating System: Ubuntu Deployment Method: Docker Number of Running Instances: T1 DB Replicaset Oplog: Yes — MongoDB replica set with oplog enabled. NodeJS Version: 22.23.3 MongoDB Version: 8.2.12 / wiredTiger Questions Is Rocket.Chat 8.5.3 Community affected by CVE-2026-111497? Is a patched Docker image planned for the 8.5.x release line, including Node.js 22.23.4 or a later patched version? If no patched image is available, what mitigation do you recommend for Community Edition deployments? Is upgrading Node.js independently within the existing Rocket.Chat Docker image supported, or could this cause application compatibility issues? Is upgrading to a newer Rocket.Chat release the recommended solution? We would prefer to remain on the 8.5.x release line if possible, and we would appreciate any official guidance on the safest upgrade or mitigation path. Thank you for your help. ### Server Setup Information - Version of Rocket.Chat Server: - Operating System: - Deployment Method: - Number of Running Instances: - DB Replicaset Oplog: - NodeJS Version: - MongoDB Version: - Proxy: - Firewalls involved: ### Any additional Information ---
**Author:** ![reetp](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/reetp/32/5546_2.png) [@reetp](https://forums.rocket.chat/u/reetp)\ **Post date:** [October 24, 2026, 7:38am UTC](https://forums.rocket.chat/t/cve-2026-111497-node-js-security-vulnerability-in-rocket-chat-8-5-3-community/23042/2 "2026-10-24T07:38:58Z")
I’ve asked for a response from the team. ---
**Author:** ![gabriel.casals](https://sea1.discourse-cdn.com/flex021/user_avatar/forums.rocket.chat/gabriel.casals/32/3790_2.png) [@gabriel.casals](https://forums.rocket.chat/u/gabriel.casals)\ **Post date:** [October 26, 2026, 1:08pm UTC](https://forums.rocket.chat/t/cve-2026-111497-node-js-security-vulnerability-in-rocket-chat-8-5-3-community/23042/3 "2026-10-26T13:08:26Z")
Folks, Security team is working on the matter and we’ll have a patch for NodeJS ---
**Author:** ![jairo.canova](https://avatars.discourse-cdn.com/v4/letter/j/aca169/32.png) [@jairo.canova](https://forums.rocket.chat/u/jairo.canova)\ **Post date:** [October 26, 2026, 4:56pm UTC](https://forums.rocket.chat/t/cve-2026-111497-node-js-security-vulnerability-in-rocket-chat-8-5-3-community/23042/4 "2026-10-26T16:56:13Z")
> > > \### Issues > > https://rocketchat.atlassian.net/browse/VLN-723 > > > > > \## Summary by …CodeRabbit > > \* \*\*Security Updates\*\* > \* Updated Docker images for Meteor and EE to use Node.js 24.22.1, including standard and FIPS variants. > \* Debian-based images now use Bookworm instead of Bullseye.