SillyTavern remote access security checklist: 11 CVEs in 2026, the Node Brotli fix (CVE-2026-111497), 6 config.yaml keys
If you use SillyTavern from your phone or another PC, check three things now: the SillyTavern version, whether your Node.js has the 2026-10-21 security patch, and privateAddressWhitelist in config.yaml. The Node bug, CVE-2026-111497, went onto CISA's list of actively exploited vulnerabilities on 202
Brief summary
What this story is about
If you use SillyTavern from your phone or another PC, check three things now: the SillyTavern version, whether your Node.js has the 2026-10-21 security patch, and privateAddressWhitelist in config.yaml. The Node bug, CVE-2026-111497, went onto CISA's list of actively exploited vulnerabilities on 202
Why it matters
Reader takeaways
- Prioritize whether the item affects internet-facing systems, databases, middleware, or identity infrastructure.
- Map the source item to your next patch window and document owners before remediation starts.
- Keep the original advisory link because patch details can change after publication.
SEO context
Topic and keyword map
This brief is filed under Oracle security alerts and Critical Patch Update watch.
aiselfhostednodesecurityOracle Critical Patch UpdateOracle security alertsOracle CVEDBA patchingsecurity advisories