【安全公告 - 2026.10.22】⚠️ Docker 用户请尽快更新镜像 / Docker Security Update Required

[MarSeventh]

各位 CloudFlare-ImgBed 用户：

Node.js 于 2026 年 10 月 21 日发布安全更新，修复了包括 Brotli 解压远程代码执行漏洞（CVE-2026-111497） 在内的多项问题。项目 Docker 版使用 Node.js，拉取外部资源时可能处理不可信的压缩响应，存在受影响风险。

我们已重新构建并推送官方 Docker 镜像，将 Node.js 更新至 22.23.4。请所有 Docker 部署用户尽快拉取新镜像并重建容器。即使图床的应用版本号没有变化，也请完成此次更新。

🐳 Docker 用户请立即更新

使用官方 Docker Compose 配置的用户，请在 docker-compose.yml 所在目录执行：

docker compose pull imgbed
docker compose up -d --force-recreate imgbed
docker compose exec imgbed node -v

最后一条命令应显示 v22.23.4 或更高的 22.x 补丁版本。如果服务名不是 imgbed，请替换为实际服务名。

• 仅重启旧容器、更新宿主机 Node.js 或更新 npm 依赖，不能替换容器内的旧运行时。
• 使用固定旧镜像标签的用户，请切换至官方 marseventh/cloudflare-imgbed:latest 或已包含本次修复的标签；不要假定所有历史标签都会更新。
• 使用 1Panel 等管理面板的用户，请拉取最新镜像后重新创建容器，并保留原有数据卷、环境变量和端口配置。
• 自行构建镜像的用户，请更新源码后使用 docker compose build --pull（Compose 配置需包含 build）或 docker build --pull 重新构建，并替换旧容器。

本次通知针对 Docker 部署。Cloudflare Pages / Workers 托管部署不需要执行上述 Docker 更新步骤。

🔗 安全更新说明

• Node.js 官方安全公告
• 本次 Docker 镜像构建记录

📢 欢迎关注 Telegram 频道

欢迎关注频道，及时获取项目动态、更新提醒和重要公告；也欢迎从频道进入交流群，分享使用经验、交流想法和反馈建议。

• Telegram 频道：Sanyue Club（可从频道进入群组）

感谢大家一直以来的支持与配合！

---

Dear CloudFlare-ImgBed users,

Node.js released security updates on October 21, 2026, fixing several vulnerabilities, including a Brotli decompression remote code execution vulnerability (CVE-2026-111497). The Docker deployment uses Node.js and may process untrusted compressed responses when fetching external resources.

We have rebuilt and published the official Docker image with Node.js 22.23.4. All Docker users should pull the updated image and recreate their containers as soon as possible, even if the application's displayed version has not changed.

🐳 Update Your Docker Deployment Now

If you use the official Docker Compose configuration, run these commands from the directory containing docker-compose.yml:

docker compose pull imgbed
docker compose up -d --force-recreate imgbed
docker compose exec imgbed node -v

The final command should report v22.23.4 or a later 22.x patch release. Replace imgbed if your service has a different name.

• Restarting an old container, updating Node.js on the host, or updating npm dependencies does not replace the runtime inside the container.
• If you pin an older image tag, switch to the official marseventh/cloudflare-imgbed:latest or a tag that includes this fix. Historical tags are not necessarily updated.
• In management panels such as 1Panel, pull the updated image and recreate the container while preserving your existing volumes, environment variables, and port settings.
• If you build your own images, update your source and rebuild with docker compose build --pull (requires a Compose build configuration) or docker build --pull, then replace the old containers.

This notice concerns Docker deployments. Cloudflare Pages / Workers deployments do not need to perform these Docker update steps.

🔗 Security Update Details

• Official Node.js security advisory
• Docker image build for this update

📢 Follow Our Telegram Channel

Follow our channel for project news, update reminders, and important announcements. You are also welcome to join the discussion group through the channel to share your experience, exchange ideas, and offer feedback.

• Telegram channel: Sanyue Club (join the discussion group through the channel)

Thank you for your continued support and cooperation!