If you use SillyTavern from your phone or another PC, critical security vulnerabilities require you to check your settings immediately. These include an actively exploited Node Brotli fix.
Heads up, SillyTavern users who access their setup remotely! There's an urgent security situation you need to address right away. If you're using SillyTavern from your phone, another PC, or any device outside your main machine by enabling `listen: true`, listen up: you might be exposed to serious vulnerabilities.
What does this mean for you? Well, a critical Node.js bug (CVE-2026-111497) that affects SillyTavern has been actively exploited and even landed on CISA's list of vulnerabilities. Alarmingly, as of late October 2026, the official Docker image for SillyTavern was still shipping an unpatched Node version. This means your remote setup could be an easy target if not secured properly.
So, what should you do right now? We recommend checking three crucial things:
1. **Your SillyTavern Version:** Outdated versions are a big risk. SillyTavern had 11 CVEs (Common Vulnerabilities and Exposures) published in 2026 alone. Version 1.16.0 fixed one, 1.17.0 fixed four, and 1.18.0 fixed six. If you're running anything older than 1.18.0, you're exposed to known issues. Make sure you're updated!
2. **Node.js Security Patch:** Verify if your Node.js installation has the security patch from October 21, 2026. This is crucial for the Brotli fix.
3. **`privateAddressWhitelist` in `config.yaml`:** Check your `config.yaml` file. The `privateAddressWhitelist` is a key setting to control who can connect. While newer versions (1.18.0 and up) include a private address filter, it's off by default. So, even if you have a newer version, you might still need to enable this.
If you've ever started SillyTavern with `listen: true` without basic authentication, user accounts, or whitelisting, you might have seen a warning message or it might have exited. However, be cautious: the `securityOverride: true` setting will let the server start even with insecure configurations, only logging a warning. Always prioritize proper access controls like whitelisting or basic authentication. A 'Warning: line saying the private address filter is off' or a 'Blocked connection from' message indicates your security is working, but the default filter being off means you need to enable it if you rely on it. Stay safe out there!
What does this mean for you? Well, a critical Node.js bug (CVE-2026-111497) that affects SillyTavern has been actively exploited and even landed on CISA's list of vulnerabilities. Alarmingly, as of late October 2026, the official Docker image for SillyTavern was still shipping an unpatched Node version. This means your remote setup could be an easy target if not secured properly.
So, what should you do right now? We recommend checking three crucial things:
1. **Your SillyTavern Version:** Outdated versions are a big risk. SillyTavern had 11 CVEs (Common Vulnerabilities and Exposures) published in 2026 alone. Version 1.16.0 fixed one, 1.17.0 fixed four, and 1.18.0 fixed six. If you're running anything older than 1.18.0, you're exposed to known issues. Make sure you're updated!
2. **Node.js Security Patch:** Verify if your Node.js installation has the security patch from October 21, 2026. This is crucial for the Brotli fix.
3. **`privateAddressWhitelist` in `config.yaml`:** Check your `config.yaml` file. The `privateAddressWhitelist` is a key setting to control who can connect. While newer versions (1.18.0 and up) include a private address filter, it's off by default. So, even if you have a newer version, you might still need to enable this.
If you've ever started SillyTavern with `listen: true` without basic authentication, user accounts, or whitelisting, you might have seen a warning message or it might have exited. However, be cautious: the `securityOverride: true` setting will let the server start even with insecure configurations, only logging a warning. Always prioritize proper access controls like whitelisting or basic authentication. A 'Warning: line saying the private address filter is off' or a 'Blocked connection from' message indicates your security is working, but the default filter being off means you need to enable it if you rely on it. Stay safe out there!
