Repository navigation
The security release: it closes Node2Shell (CVE-2026-111497), a remote-code-execution flaw in the Brotli decoder bundled with the JavaScript runtime that an anonymous caller could reach with a single request, along with a denial of service in the request body parser. Update every instance; there is no migration and nothing to redo by hand.
🔒 Security
- Node2Shell (CVE-2026-111497) is closed — the runtime's Brotli decoder could write out of bounds on a crafted stream, and MySpeed decoded Brotli-compressed request bodies before any password check, so anyone who could reach the port could trigger it. MySpeed now runs on Bun 1.4.4, which carries the fix, and refuses Brotli-compressed request bodies outright with 415 before any body is read. No legitimate client is affected: browsers never compress request bodies.
- Request body parser denial of service — trailing bytes after a compressed request body could hang the parser, also before authentication (GHSA-27r3-jxmh-p828). body-parser is now 2.4.
- Patched transitive libraries — Moment 2.31 (path traversal via a crafted locale name, GHSA-4p3w-j4w9-5jqw), plus build-time tooling: fast-uri, brace-expansion, source-map-js, serialize-javascript and Zod. Both dependency trees now audit clean.
🔧 Runtime
- Bun 1.4.4 — the binaries, installers and Docker image are built on Bun 1.4.4, and installs from source now require Bun 1.4.4 or newer. If you run MySpeed from source, upgrade Bun before updating.
If you cannot update right away, reject requests carrying Content-Encoding: br at your reverse proxy.
Runtime compatibility
Source installs require Bun 1.4.4 or newer, or Node.js 22.19.0 or newer for development and tests. The x64 compiler target is Nehalem/SSE4.2 with runtime AVX dispatch; the baseline filenames are compatibility aliases. The Windows executable was verified in a KVM guest on the Westmere-v2 CPU model with AVX and AVX2 disabled (SSE4.2/POPCNT present).
Qualification scope and limitations
v1.7.2 uses the owner-approved-reduced-cpu-floor-gated qualification scope. Linux, macOS, source-runtime and Docker checks passed. Windows binaries passed listener-free reset and version checks; installers passed build/provenance checks and WiX ICE validation. On the Westmere-v2 guest CPU with AVX and AVX2 disabled, the exact published Windows executable started, served its loopback listener and stopped cleanly. Windows native HTTP/service runtime with enforced outbound denial and the complete Windows MSI install/upgrade/rollback/uninstall lifecycle are not verified; these two checks are deferred, not passed. See the qualification manifest for the exact evidence and artifact digests.
Downloads
| Platform | x86-64 | ARM64 |
|---|---|---|
| Windows | EXE · MSI · EXE (no AVX2) · MSI (no AVX2) | — |
| Linux | Binary · No AVX2 | Binary |
| macOS | Binary | Binary |
Both Windows executables are byte-identical; the baseline filenames are compatibility aliases.
Source Distribution
- ZIP Archive (requires Bun 1.4.4 or newer)
Docker Images
i7gamer/myspeed:latesti7gamer/myspeed:1.7.2
Installation Scripts
Checksums and Qualification
What's Changed
- Point unpinned Ookla runs on dual-stack Windows at an IPv4-only server by @i7Gamer in #114
- Give the Stage 2 snapshot update its own bounded timeout and retry by @i7Gamer in #115
- Retry Stage 2 snapshot downloads on server and network failures by @i7Gamer in #117
- Fall back to the live archive for pool files the snapshot keeps failing by @i7Gamer in #118
- Gate every release after 1.7.1 on the Windows AVX-disabled CPU-floor check by @i7Gamer in #116
- chore(deps): bump the client-minor-and-patch group in /client with 6 updates by @dependabot[bot] in #120
- chore(deps): bump the server-minor-and-patch group with 6 updates by @dependabot[bot] in #119
- Close Node2Shell (CVE-2026-111497) and open dependency advisories by @i7Gamer in #121
Full Changelog: v1.7.1...v1.7.2
