From 34807adf3b0b8981f2c0d381c70ed1d9a2a7657a Mon Sep 17 00:00:00 2001
From: "Torsten Schulz (local)" <tsschulz@gmx.net>
Date: Tue, 27 Oct 2026 15:32:16 +0100
Subject: [PATCH] =?UTF-8?q?fix:=20sichere=20Brotli-Laufzeit=20ab=20und=20e?=
 =?UTF-8?q?rh=C3=B6he=20Patchversionen?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .nvmrc                                |  1 +
 backend/.nvmrc                        |  1 +
 backend/package-lock.json             |  7 +++++--
 backend/package.json                  |  5 ++++-
 backend/scripts/require-safe-node.cjs | 22 ++++++++++++++++++++++
 backend/server.js                     |  1 +
 package-lock.json                     |  7 +++++--
 package.json                          |  5 ++++-
 8 files changed, 43 insertions(+), 6 deletions(-)
 create mode 100644 .nvmrc
 create mode 100644 backend/.nvmrc
 create mode 100644 backend/scripts/require-safe-node.cjs

diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 00000000..ce62013c
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.22.1
diff --git a/backend/.nvmrc b/backend/.nvmrc
new file mode 100644
index 00000000..ce62013c
--- /dev/null
+++ b/backend/.nvmrc
@@ -0,0 +1 @@
+24.22.1
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 87ba90fc..6f742a5b 100755
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "backend",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "backend",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "hasInstallScript": true,
       "license": "ISC",
       "dependencies": {
@@ -37,6 +37,9 @@
         "cross-env": "^7.0.3",
         "nodemon": "^3.1.4",
         "vue-eslint-parser": "9.4.3"
+      },
+      "engines": {
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
       }
     },
     "node_modules/@babel/runtime": {
diff --git a/backend/package.json b/backend/package.json
index 35ec1f33..8b74f3f5 100755
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "backend",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "main": "server.js",
   "type": "module",
   "scripts": {
@@ -42,5 +42,8 @@
     "cross-env": "^7.0.3",
     "nodemon": "^3.1.4",
     "vue-eslint-parser": "9.4.3"
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   }
 }
diff --git a/backend/scripts/require-safe-node.cjs b/backend/scripts/require-safe-node.cjs
new file mode 100644
index 00000000..b5c73115
--- /dev/null
+++ b/backend/scripts/require-safe-node.cjs
@@ -0,0 +1,22 @@
+// CVE-2026-111497: Node's bundled Brotli decoder must include the security fix.
+// Check Node versions: patched releases can still report Brotli 1.2.0.
+// https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
+'use strict';
+
+function requireSafeNode() {
+  const [major, minor, patch] = process.versions.node.split('.').map(Number);
+  const minimum = { 22: [23, 4], 24: [22, 1], 26: [12, 1] }[major];
+  const patched = minimum && (minor > minimum[0] ||
+    (minor === minimum[0] && patch >= minimum[1]));
+
+  if (!patched) {
+    throw new Error(
+      `CVE-2026-111497: Node.js ${process.versions.node} is not an approved patched runtime. ` +
+      'Use Node.js 22.23.4+, 24.22.1+ or 26.12.1+ within those release lines. ' +
+      'Recommended: nvm install && nvm use (see .nvmrc). Restart all server/PM2 processes after upgrading.'
+    );
+  }
+}
+
+requireSafeNode();
+module.exports = requireSafeNode;
diff --git a/backend/server.js b/backend/server.js
index a237961e..ab7472e2 100755
--- a/backend/server.js
+++ b/backend/server.js
@@ -1,3 +1,4 @@
+import './scripts/require-safe-node.cjs';
 import express from 'express';
 import path from 'path';
 import { fileURLToPath } from 'url';
diff --git a/package-lock.json b/package-lock.json
index ce300531..3ad91332 100755
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "trainingstagebuch",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "trainingstagebuch",
-      "version": "1.0.0",
+      "version": "1.1.1",
       "license": "ISC",
       "dependencies": {
         "@babel/eslint-parser": "^7.25.1",
@@ -21,6 +21,9 @@
         "eslint": "^8.57.0",
         "eslint-config-airbnb-base": "^15.0.0",
         "eslint-plugin-import": "^2.29.1"
+      },
+      "engines": {
+        "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
       }
     },
     "node_modules/@ampproject/remapping": {
diff --git a/package.json b/package.json
index 135e894a..2a508d11 100755
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "trainingstagebuch",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "main": "index.js",
   "scripts": {
     "dev": "concurrently \"cd backend && npm run dev\" \"cd frontend && npm run dev\"",
@@ -27,5 +27,8 @@
     "@babel/eslint-parser": "^7.25.1",
     "vue-eslint-parser": "^9.4.3",
     "vue-multiselect": "^3.0.0"
+  },
+  "engines": {
+    "node": "^22.23.4 || ^24.22.1 || ^26.12.1"
   }
 }