Release Note
Last verified 26 Oct 2026
DigitalOcean Harness Runtime platform templates have been rebuilt to address CVE-2026-111497, a remote code execution vulnerability in the Brotli decoder affecting Node.js and other components. The updated templates are codex, claude-code, opencode, hermes, and openhands, along with the LangGraph and CrewAI base images. Sessions created after this update use the patched templates automatically. If you use a custom template (BYOT), rebuild it on the patched base template before creating new sessions.
Existing running or paused sessions continue to use the image they were created from, and resuming, checkpointing, or forking a session does not apply the fix. To remediate, remove affected sessions and create new ones from your existing environment spec or Agent Config. For more information, see How to Manage Harness Runtime Sessions and How to Use a Custom Sandbox Template (BYOT).
codex,claude-code,opencode: Node.js 20 to Node.js 24.22.1hermes: Hermes Agent v0.22.5, Node.js 26.12.1, Python 3.14openhands: OpenHands agent server 1.58.2, Node.js 24.22.1