[Security] Update Node.js to 24.22.1+ to fix CVE-2026-111497 (Brotli decoder RCE) #2324

Summary

Please publish new WAHA images built on a patched Node.js release to address CVE-2026-111497 (High): an out-of-bounds write in the Brotli decoder that permits remote code execution.

• Advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases (October 21, 2026)
• Affected: Node.js 22.x, 24.x, 26.x (and EOL lines)
• Fixed in: 22.23.4 / 24.22.1 / 26.12.1

The same release also fixes several other High issues (TLS hostname-check bypasses CVE-2026-105483 / CVE-2026-106069, dns.resolve NUL truncation CVE-2026-105482) and updates OpenSSL, c-ares and Undici.

Current state

The latest published image, devlikeapro/waha:gows-2026.9.2 (sha256:1ae3c6a994ee97e5039bf41103193d7bf9175f1a31db73ba89bdeed6277901bc, released 2026-10-02), ships Node.js v24.11.1:

$ docker run --rm --entrypoint node devlikeapro/waha:gows-2026.9.2 -v
v24.11.1

The patched base images are already available on Docker Hub: node:24.22.1-bookworm and node:24.22.1-bookworm-slim.

Request

Could you rebuild and publish all variants (WEBJS, NOWEB, GOWS, including -arm) on Node.js 24.22.1 or later? A patch release would be much appreciated, since users who pin by digest can't pick up the fix until a new tag is out.

Thanks for maintaining WAHA!