Every BROKA security advisory, as it is published or updated. https://broka.dev/security/advisories 2026-10-24T00:00:00Z BROKA https://broka.dev/security/advisories/BROKA-SA-2026-005 2026-10-24T00:00:00Z 2026-10-24T00:00:00Z

Image scanners report four high-severity CVEs in the console image of 1.0.0 through 1.3.1: three in nginx 1.30.5, its web server, each needing an nginx configuration BROKA does not have, and one in the Brotli library, which nothing in the running console uses. 1.3.2 runs nginx 1.30.6 and Brotli 1.2.1, which fix all four. Severity: High. Not exploitable in any configuration BROKA ships. Affected: 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.3.0, 1.3.1. Fixed in: 1.3.2.

https://broka.dev/security/advisories/BROKA-SA-2026-004 2026-10-24T00:00:00Z 2026-10-24T00:00:00Z

Image scanners report two high-severity CVEs in the console image of 1.0.0 through 1.3.0: libexpat and libX11, both pulled in only for nginx's image-filter module, which BROKA never loads. 1.3.1 carries the fixed versions of both. Severity: High. Not exploitable in any configuration BROKA ships. Affected: 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.3.0. Fixed in: 1.3.1.

https://broka.dev/security/advisories/BROKA-SA-2026-003 2026-10-24T00:00:00Z 2026-10-24T00:00:00Z

Microsoft's October 2026 .NET and ASP.NET Core advisories apply to the .NET 10.0.12 runtime of the Orchestrator in 1.0.0 through 1.2.1. Nine do not reach BROKA as shipped; three do — a crafted date filter from a signed-in user can end the Orchestrator, a multipart body can make it reserve far more memory than it was sent, and a client that disconnects mid-request can have a request hidden in its body processed. 1.3.0 runs on .NET 10.0.13, which fixes all twelve. Severity: Critical. Three of the twelve are reachable in 1.0.0–1.2.1; upgrade to 1.3.0 or later. Affected: 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1. Fixed in: 1.3.0.

https://broka.dev/security/advisories/BROKA-SA-2026-002 2026-10-15T00:00:00Z 2026-10-16T00:00:00Z

Microsoft's 13 October 2026 advisories for System.Security.Cryptography.Xml and System.Security.Cryptography.Pkcs apply to the .NET 10.0.12 runtime in the Orchestrator images of 1.0.0 through 1.2.1. All five are denial-of-service flaws in XML signature and encryption and in CMS processing, which BROKA never performs; 1.3.0 runs on .NET 10.0.13. Severity: High. Not exploitable in any configuration BROKA ships. Affected: 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1. Fixed in: 1.3.0.

https://broka.dev/security/advisories/BROKA-SA-2026-001 2026-10-11T00:00:00Z 2026-10-11T00:00:00Z

Image scanners report five high-severity CVEs in the broker service and console images of 1.0.0 through 1.1.2: lz4-java, the Go standard library inside an unused binary, and libtiff. None is reachable in the way BROKA ships; 1.2.0 removes all five. Severity: High. Not exploitable in any configuration BROKA ships. Affected: 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2. Fixed in: 1.2.0.