[yanjost]

Summary

Add SSB-2026-007 for CVE-2026-111497. The bulletin explains affected Node.js versions, the buildpack update, the planned rejection of incoming requests with Content-Encoding: br, and the customer steps to upgrade and verify their runtime.

Source issue: CVE-2026-111497. The fixed runtime inventory is in Scalingo/nodejs-buildpack#286.

Security review (self)

• The bulletin contains public information only. No secrets, tokens, credentials, or internal URLs or hostnames were introduced.
• No user-input handling or authentication code changed. I reviewed the advice for unsafe Node.js version pins, inbound request filtering, outbound Brotli responses, and the support exception.

Test plan

• docker compose run --rm web bundle exec jekyll build — generated the bulletin page successfully.
• Checked the rendered local page for the filtering time and support exception, and verified its links do not point to JSON documents.

Add the publication time and changelog entry once the public bulletin is live.

[SC-Jerome-S]

Perfect - LGTM