Rebuild for Node.js CVE-2026-111497 (Node2Shell) #109

Hi!

Tag 42 / latest ships Node 22.23.2. The Oct 21 Node security release fixes a Brotli decoder out-of-bounds write (CVE-2026-111497) in 22.23.4. This image runs Express 5 + body-parser 2.3, which decompress Content-Encoding: br request bodies, so the vulnerable path is reachable from any client. The Dockerfile already uses node:22-alpine, so a new tag (rebuild) should be enough. Dependabot #108 could go in the same release.

Advisory: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases