SillyTavern remote users urged to patch Node Brotli RCE now on CISA's exploited list

Anyone running SillyTavern, the self-hosted LLM chat frontend, and reaching it from a phone or a second PC should check three things now: the SillyTavern version, whether their Node.js build carries the 2026-10-21 security patch, and the access-control keys in config.yaml. That is the core advice of a security checklist published on dev.to on 2026-10-28, and its urgency comes from CVE-2026-111497, a remote code execution flaw in Node's Brotli decoder that, according to the post, CISA added to its Known Exploited Vulnerabilities catalog on 2026-10-27.

The Brotli flaw and the patch gap

Node.js fixed the issue in its 2026-10-21 security release and rated it High, while NVD assigns a CVSS 4.0 score of 9.2, the dev.to post notes. The root cause is an out-of-bounds write in the Google Brotli decoder that Node bundles: an application that decompresses someone else's Brotli data through node:zlib can end up with corrupted process memory and remote code execution. Patched versions are v22.23.4, v24.22.1 and v26.12.1; the 20.x and 25.x lines have no fix and are already past end of life.

The KEV entry names Google Brotli as the product and sets a remediation deadline of 2026-11-10, with NVD listing exploitation as active. The post adds caveats worth knowing: neither CISA nor NVD says the known exploitation targeted Node.js or SillyTavern, and the nodejs.org advisory itself did not mention exploitation as of 2026-10-28. A Korean KISA advisory covering the same Node release lists three other CVEs but omits this one, and the "Node2Shell" name circulating informally appears on neither nodejs.org nor NVD.

How SillyTavern is exposed

The author, who tested releases 1.17.0 and 1.19.0 locally, traces the exposure to outbound requests. SillyTavern contacts whatever API address is configured, and its request headers advertise Brotli support in accept-encoding. Around 30 files under src use node-fetch, and node-fetch 3.3.2 decodes Brotli responses through zlib.createBrotliDecompress(); the global fetch uses the same decoder. Incoming request bodies are not a vector, since body-parser 1.20.4 only inflates gzip and deflate and rejects Brotli with a 415. The risk therefore runs through responses SillyTavern fetches — API endpoints, the search proxy and asset URLs — which matters most when an API proxy is operated by someone you do not know. The author notes they did not test a malicious response; the analysis stops at headers and source code.

Eleven CVEs, all fixed by 1.18.0

Counting GitHub Security Advisories pulled via the GitHub API, the post tallies 11 SillyTavern CVEs published in 2026: one fixed in 1.16.0, four in 1.17.0 and six in 1.18.0, so anything older than 1.18.0 is exposed to at least six. Two stand out. CVE-2026-44650, a path traversal in extension deletion rated critical 9.1, requires no login. CVE-2026-44649, an authentication bypass via SSO headers rated 9.8, only applies if SSO header authentication is enabled.

Four of the eleven are SSRF bugs, and the maintainers' response, per advisory GHSA-qg89-qwwh-5f3j, was to add the privateAddressWhitelist setting in 1.18.0; future SSRF reports will only be accepted if they bypass that filter. The filter is off by default, so switching it on is the user's job. The same applies to hostWhitelist, added in 1.13.4 against the 2025 DNS rebinding bug CVE-2025-59159 (critical 9.6).

What to check

• With listen: true and no whitelist, basic authentication or user accounts, SillyTavern refuses to start and exits with code 1 — unless securityOverride: true is set, in which case it only logs a warning.
• Run node -v. If the result is unclear, the zlib constant BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH is present on patched builds and absent on unpatched ones. Do not rely on process.versions.brotli: because Node cherry-picked the fix rather than upgrading the library, it reports the same value before and after the patch.
• Docker users are not automatically covered. As of 2026-10-28, the official latest and 1.19.0 images (both built 2026-09-14) bundle Node 24.21.0, which is unpatched; only the staging tag carries 24.22.1. The docs' "No action required" holds only once the image is rebuilt — re-pulling latest returns the same image.
• Two of the CVEs, in the CORS proxy, apply only if enableCorsProxy is on; its default is false.

Why it matters

Self-hosted LLM frontends occupy an awkward middle ground: they run on personal hardware, often managed by people who are not administrators, yet they expose an HTTP interface beyond localhost and fetch data from third-party endpoints. Here the effective security posture rests on defaults that are off unless the user acts — privateAddressWhitelist, hostWhitelist — plus a runtime the application does not control and a Docker image whose latest tag lags the patch. With CISA listing the Brotli bug as actively exploited and a 2026-11-10 remediation date, a short audit — SillyTavern 1.18.0 or newer, a patched Node line, and the whitelist keys enabled — closes both the application and runtime gaps at once.