Docker image update for HTTP2Shell (CVE-2026-111497)

[WhiteNoise0000]

Are there plans to publish an updated official Docker image for the already-public Brotli vulnerability CVE-2026-111497 (HTTP2Shell)?

Both unclecode/crawl4ai:0.9.5 and :latest were last updated on October 14. If a patched image is planned, is there an expected release date?

Thanks for maintaining Crawl4AI.

AI-assisted drafting.

[kamilkaczmareksolutions]

can't speak for a release date, but you can patch it yourself today. i exported unclecode/crawl4ai:0.9.5 (amd64) and the vulnerable brotli copies are:

• libbrotli1 from Debian, 1.0.9-2+b6, fixed in 1.0.9-2+deb12u1 (DLA-4855-1, 2026-10-23)
• the PyPI brotli 1.2.0 wheel, which crawl4ai itself requires, fixed in 1.2.1
• the Node bundled in the Playwright and Patchright drivers: v24.21.0 with brotli 1.2.0. the fix is Node 24.22.1 (Node advisory), which playwright-python 1.64.1 bundles. it's the same browser builds as 1.64.0, so nothing gets re-downloaded
• pillow 12.3.0 vendors libbrotli 1.2.0. the bump is on Pillow main (#10340) but no release has it yet, see Pillow#10386

FROM unclecode/crawl4ai:0.9.5
USER root
RUN apt-get update && apt-get install -y --only-upgrade libbrotli1 \
 && rm -rf /var/lib/apt/lists/* \
 && pip install --no-cache-dir -U "brotli>=1.2.1" "playwright>=1.64.1"
USER appuser

patchright's driver also runs Node 24.21.0. check that a newer patchright release ships Node 24.22.1+ before bumping it. pillow stays flagged until it ships a release

[WhiteNoise0000]

Thanks for checking the image and sharing your findings. The detail about Pillow’s bundled Brotli was particularly helpful. I appreciate you taking the time to investigate.