Release Note

Last verified 26 Oct 2026

DigitalOcean Harness Runtime platform templates have been rebuilt to address CVE-2026-111497, a remote code execution vulnerability in the Brotli decoder affecting Node.js and other components. The updated templates are codex, claude-code, opencode, hermes, and openhands, along with the LangGraph and CrewAI base images. Sessions created after this update use the patched templates automatically. If you use a custom template (BYOT), rebuild it on the patched base template before creating new sessions.

Existing running or paused sessions continue to use the image they were created from, and resuming, checkpointing, or forking a session does not apply the fix. To remediate, remove affected sessions and create new ones from your existing environment spec or Agent Config. For more information, see How to Manage Harness Runtime Sessions and How to Use a Custom Sandbox Template (BYOT).

  • codex, claude-code, opencode: Node.js 20 to Node.js 24.22.1
  • hermes: Hermes Agent v0.22.5, Node.js 26.12.1, Python 3.14
  • openhands: OpenHands agent server 1.58.2, Node.js 24.22.1

We can't find any results for your search.

Try using different keywords or simplifying your search terms.