Node.js patch day, EcoFlow pulls the plug, and a receipt printer that runs the family

Homelab Highlights for 2026-10-23: self-hosting and homelab notes worth knowing.

[Audio embed placeholder]

The Lead: Node.js critical vulnerabilities

Node.js shipped security releases patching a Brotli decoder out-of-bounds write with a CVSS of 9.8. Affected versions: Node 22 before 22.23.4, Node 24 before 24.22.1, and Node 26 before 26.12.1. The advisory was lighter on detail than usual, but Stripe’s notification emails suggested the Brotli issue could be remote code execution.

Why it matters: A ton of self-hosted software runs on Node.js, including Overseerr and Seerr. The practical move is figuring out which containers embed a Node runtime and checking the version inside, not just the app version on the label. A tunnel reduces exposure but doesn’t fix the bug.

Source: nodejs.org

News Roundup

EcoFlow asks developers of open-source Home Assistant integration to stop development, project now maintenance-only

EcoFlow contacted the developers of ha-ef-ble, the open-source Home Assistant integration that monitors and controls EcoFlow power stations over Bluetooth without the cloud, asking them to stop citing safety concerns. The maintainers put the project into maintenance-only mode: fixes for existing devices continue, but no new device support will be added. EcoFlow has been working on an official local API but shared no meaningful details.

Why it matters: A reminder that local control of gear you own can hinge on one vendor’s goodwill. Community developers put considerable effort into making EcoFlow’s hardware more useful, and rather than supporting that effort, EcoFlow has threatened legal action.

Source: r/homeautomation - Homelab Highlights top (day)

Unraid 7.4.0-rc.2 Now Available

Unraid 7.4.0 release candidate two ships PHP 8.4.27 patching two critical unauthenticated remote code execution vulnerabilities (CVE-2026-109618 and 109619, both CVSS 9.2), plus a kernel bump to 6.18.58. Unraid also shipped 7.3.4 on the stable channel with the same PHP fixes. The RC is test machines only.

Why it matters: If PHP exists anywhere in your stack, this week is the week to check it. As one commenter put it, if the web UI isn’t exposed to the internet, the risk profile is a lot calmer.

Source: r/unRAID - Homelab Highlights top (day)

Yunohost // ☢ [CVE-2026-109618/109619] Critical vulnerability in PHP, upgrade system package ASAP!

YunoHost’s forum is running an advisory urging users to upgrade the system PHP package as soon as possible to patch the same CVE-2026-109618/109619 pair hitting Unraid.

Why it matters: Between Unraid and YunoHost, if PHP exists anywhere in the stack — even buried inside a container — this week is the week to check it.

Source: Lemmy.World - selfhosted

Pangolin 1.25: Redirects, mTLS, and Machine Roles

Pangolin 1.25 adds HTTP redirects at the proxy level with exact, prefix, and regex matching, mutual TLS for public resources (clients need a certificate from a CA you trust before they reach the auth page), and roles for machine clients. One upgrade hiccup: a Traefik and Badger plugin version mismatch tripped up some updaters.

Why it matters: A solid upgrade for anyone exposing homelab services through identity-aware tunnels. mTLS blocks unknown devices before they reach your resource, and machine roles let servers and automation share access as a group.

Source: github.com

Tool & Software Highlight: Open-source DDoS detection and mitigation for Linux, with Prometheus metrics and Discord alerts

NetDeflect is an Apache-2.0 tool that detects and mitigates DDoS floods and reflection attacks on Linux boxes you expose — game servers, VPNs, Jellyfin — with Prometheus metrics and Discord alerts. It samples traffic, classifies attacks on header fields using 110 signatures plus fingerprinting, and drops them in the kernel via XDP or nftables. It never bans spoofed source addresses, learns regular users, and has a watch-only mode.

Why it matters: The usual answers are a paid protection service (Cloudflare doesn’t cover Jellyfin or UDP) or hand-rolling firewall rules that ban real users. NetDeflect is a lightweight, open-source alternative that does detection and response automatically.

Source: github.com

Community Highlight: My Pi prints a little receipt for the family every morning: weather, puzzles, chores, bedtime stories

A Pi 3B plus an eBay Epson TM-T88V receipt printer prints the family a ticket at 7AM on weekdays: weather with a what-to-wear line, a riddle with the answer upside down, a sudoku, rotating chores for the kids, birthdays, bin day, the shopping list, and the daily Lichess chess puzzle. The whole thing is one Rust binary, no database, no cloud required, and it shows up in Home Assistant over MQTT.

Why it matters: A charming, cheap weekend build the whole household actually uses. The engineering under the hood is interesting: no drivers, no CUPS, ESC/POS straight to USB, and three dithering algorithms for raster images. BPS-free paper is worth seeking out for a household project.

Source: r/raspberry_pi - Homelab Highlights top (day)

Sources

Transcript

Host A: Welcome to Homelab Highlights, the show that surfaces practical homelab wins and useful self-hosted tools.

HOST A: Node.js shipped security releases today, and one of the fixes is a Brotli decoder out-of-bounds write with a CVSS of 9.8. That kind of score gets everyone’s attention, because Brotli decompression of attacker-controlled data can crash a process, leak memory, or in the worst case run code. And a ton of self-hosted stuff runs on Node. The thread that surfaced this pointed at Overseerr and Seerr specifically, and people were scrambling to check what version their containers are actually running. The affected lines are Node 22 before 22.23.4, Node 24 before 24.22.1, and Node 26 before 26.12.1. One correction worth making on air, since it got muddled in the discussion: Plex itself is written in Go and C++, so the core Plex server isn’t a Node app — Seerr is the piece that uses Node, and someone suggested Plexamp was what the original poster was thinking of. HOST B: That’s the annoying part of containerized setups, right? The tag says one thing and the bundled runtime says another. The practical move is figuring out which of your containers embed a Node runtime and checking the version inside it, not just the app version on the label. And the honest read is that the advisory page was lighter on detail than a security post usually is — one commenter noted Stripe’s notification emails suggested the Brotli issue could be remote code execution, while the page mostly listed highs. So treat it as urgent regardless of the exact label. HOST A: The thread’s other big theme was exposure. One person said it’s finally time to close every port except WireGuard and Tailscale, and the reply was basically, that time was years ago. Another operator runs everything behind a Cloudflare tunnel and WAF, so the attack surface is tiny, but still updated right away — a tunnel reduces exposure, it doesn’t fix the bug. For a real homelab, the workflow is: pull fresh images for anything Node-based, restart, and if you build your own images, bump the base image so the runtime inside actually changes.

HOST B: Alright, a few more things worth knowing about today. HOST A: Starting with a local-control story that has some real sting to it. EcoFlow contacted the developers of ha-ef-ble — the open-source Home Assistant integration that monitors and controls EcoFlow power stations over Bluetooth without the cloud — and asked them to stop, citing safety concerns around the Bluetooth protocol. The maintainers put the project into maintenance-only mode: fixes for existing devices continue, but no new device support. The person who posted this owns the hardware and uses the integration, and found the whole thing pretty disappointing, especially since EcoFlow has apparently been working on an official local API but shared no meaningful details. Nobody’s blaming the volunteers for not wanting a legal fight with a company that size — but it’s a reminder that local control of gear you own can hinge on one vendor’s goodwill. HOST B: Then, over on the Unraid side. Version 7.4.0 release candidate two is out, and it’s mostly a security refresh — PHP 8.4.27 patching two critical unauthenticated remote code execution vulnerabilities, CVE-2026-109618 and 109619, both scoring 9.2, plus a kernel bump to 6.18.58. But no rush needed on the RC: Unraid also shipped 7.3.4 on the stable channel with the same PHP fixes, and that’s the one for production servers. The RC is test machines only. And as one commenter put it, if the web UI isn’t exposed to the internet anyway, the risk profile is a lot calmer. HOST A: And the same PHP vulnerabilities are hitting another platform. YunoHost’s forum is running an advisory urging users to upgrade the system PHP package as soon as possible. So between Unraid and YunoHost, if PHP exists anywhere in the stack — even buried inside a container — this week is the week to check it. HOST B: And finally, a nice update for anyone using Pangolin. Pangolin 1.25 is out, the open-source identity-aware remote access platform, with two long-requested features: HTTP redirects at the proxy level, with exact, prefix, and regex matching, and mutual TLS for public resources — clients need a certificate from a CA you trust before they even reach the auth page. There are also roles for machine clients now, so servers and automation can share resource access as a group. One upgrade hiccup worth knowing: a Traefik and Badger plugin version mismatch tripped up some updaters, though the maintainers say a recent container holds off on the automatic update. If you’re coming from Cloudflare Tunnel with one-time passwords, the same OTP flow works here.

HOST A: For the tool spotlight, this one is for anyone running a game server, VPN endpoint, or Jellyfin box on a VPS. It’s called NetDeflect, it’s Apache-2.0 licensed, and it does open-source DDoS detection and mitigation on Linux — floods and reflection attacks, detected and dropped on the machine itself, with Prometheus metrics and Discord alerts. HOST B: The problem it’s solving is real. The usual answers are a paid protection service — and the developer points out Cloudflare doesn’t cover Jellyfin or UDP traffic — or hand-rolling firewall rules that happily ban real users when they misfire. NetDeflect samples traffic, classifies attacks on actual header fields using about 110 signatures plus fingerprinting for ones it doesn’t recognize, and drops them in the kernel. Crucially, it never bans spoofed source addresses, which is exactly the failure mode that gets your own users locked out. HOST A: The design details are what make it interesting. Detection runs in userspace, so when traffic crosses a threshold it samples a fixed number of packets — meaning a 50,000 packet-per-second flood and a 5 million pps flood cost the same to analyze. The dropping happens in the kernel via XDP or nftables, and it can even call external firewall APIs at providers like OVH to block IPs upstream. It also learns your regular users and lets them through first during an attack, and there’s a watch-only mode so it can sit against real traffic before it blocks anything. Honest limits are stated plainly: an attack bigger than the connection fills the pipe before it reaches the server — that has to be handled upstream. Deployment is genuinely light: one command, optionally a systemd service, and it only filters interfaces you pick, so Docker networks stay untouched.

HOST B: For the community highlight, a Raspberry Pi build that is both clever and charming. Someone hooked an Epson TM-T88V receipt printer from eBay up to a Pi 3B, and now the family gets a little printed ticket at 7AM on weekdays: weather with a what-to-wear line, a riddle with the answer printed upside down, a sudoku, rotating chores for the kids — which reportedly ended a lot of arguments — birthdays, bin day, the shopping list, even the daily Lichess chess puzzle with the board drawn on the receipt. HOST A: The engineering under the hood is where it gets interesting. No drivers, no CUPS — it sends ESC/POS straight to the USB device, using the printer’s own fonts for text and rendering everything else as 512-dot-wide dithered raster images, with three different dithering algorithms because photos and line drawings want different treatment. The whole thing is one Rust binary, no database, no cloud required, and it runs fine on a 3B. The debugging war stories are worth the read too: the ESC/POS status commands deadlock the USB link when the cover is open, so the working trick is the kernel usblp driver’s status ioctl, which never leaves anything pending and can tell out-of-paper from cover-open. HOST B: It also shows up in Home Assistant over MQTT, so the doorbell can print a note when someone rang. One practical note from the comments: thermal receipt paper can contain bisphenol S, though BPS-free paper exists and costs only a little more — worth seeking out for a household project. The code is Apache-2.0 on GitHub under the name Printr, and the developer is asking whether it works on other ESC/POS printers, so if there’s a receipt printer in a drawer somewhere, that’s an invitation.

Host A: That’s Homelab Highlights for Friday. Until next time, happy hosting!