A Node.js Security Fix, rTorrent Only Where You Want It, and a QuickBox Interface for Transmission

This release has three big stories. First, security: the dashboard, and every app that brings its own Node.js, moves to the patched Node.js from the October 21 security release. Second, rTorrent is no longer forced on every new account. It is now an app each account installs only if it wants it, and that install sets up just that account. Third, Transmission gets a brand new interface that matches your dashboard. On top of that, regular users can now ask an administrator to install a torrent client.

Everything below has landed since the last stable release, core 3.2.2.9974 and dashboard 4.0.1.3892.

This one release needs a full QuickBox update, not the dashboard-only one. Either of these works:

• In the dashboard: System > Changelog, then Update QuickBox under Maintenance.
• In a terminal:

qb update quickbox

Please don't use the Update dashboard button for this release. The dashboard you run today can't switch its own Node.js runtime, so that path stops partway, rolls back, and leaves you on the version you already had. If you already pressed it, nothing is lost: run qb update quickbox and it completes normally.

You only have to do this once. From this release on, a dashboard-only update hands over to the updater that ships inside the new release, so future runtime changes work from that button too.

To confirm you are on the patched runtime afterwards:

/opt/v4-dashboard/lib/nodejs/current/bin/node -v

It should print v22.23.4.

The v4 dashboard ships its own copy of Node.js. Until now that copy was 22.14.0, and updates kept whatever version a server already had. This release moves it to 22.23.4, the patched version from the Node.js October 21, 2026 security release.

The headline fix in that release is CVE-2026-111497, rated High: malformed Brotli-compressed data can make Node's decoder write past the end of a buffer, which can lead to a crash, a memory leak or remote code execution. The same release also fixes several other issues on the 22 line, including TLS hostname checks that could be fooled by unusual spellings of an IP address. Updating picks up all of them.

How exposed you are right now. The bug only triggers when Node unpacks Brotli data an attacker controls. The dashboard never unpacks data sent to it, so nobody can trigger it by sending requests to your dashboard. The only way to reach it is through a reply from a server the dashboard itself connects to, and only if that server is malicious or someone intercepts the connection. The outside services the dashboard talks to are all reached over HTTPS, and the way it talks to Plex, Emby and Jellyfin never unpacks Brotli. Low risk, but it is a real fix and you should take it.

We discussed this in the open in our Discord support forum: Bundled dashboard Node needs bumping for CVE-2026-111497.

Two things changed in how updates handle Node.js, so a security release like this never gets stuck again:

• The updater now installs the Node.js version the new release was built for, builds with it, and switches it in together with the release.
• If an update fails and rolls back, the previous Node.js comes back with the previous release. The old runtime is never deleted.

We also raised four dashboard dependencies past their published advisories: undici, fast-uri, nodemailer and zod.

The dashboard isn't the only thing on your server running Node.js. Several apps install their own private copy, separate from the dashboard's, and each had its version set by its own installer. None of them picked up the fix from the dashboard update, so this release moves them too:

One app this can't reach yet: Flood. Flood is installed as its developers' official release, a single program file with its own Node.js built in. The latest Flood release carries Node.js 22.23.2, which is below the fix, and QuickBox can't swap the Node.js inside that file. When Flood's developers publish a release built on a patched Node.js, update Flood with the Update badge on its row in the App Dashboard, or with qb update flood -u username. Flood only listens on your server itself, behind the web server, but it does fetch outside addresses such as RSS feeds, so please update it when that release lands.

You don't have to do anything for this. Every QuickBox update checks each of these apps for each account. When an app's Node.js is below the patched version, it moves it up and restarts that app if it was running. It also restarts an app that is still running an old copy of Node.js from before, and leaves every other app alone. If anything fails, the app keeps its old Node.js and keeps working, and you get one warning. Installing or updating one of these apps puts it on the patched version too.

QuickBox also keeps its own shared copy of Node.js, the one apps are built with when you install or update them. It moves to the patched version too, and the old unpatched and end-of-life versions it no longer needs are removed. Transmission and Headphones no longer install a Node.js they never used.

From now on, one setting holds the minimum Node.js for all of them, so the next Node.js security release is a one-line change on our side.

To see which Node.js an app runs, for example Seerr:

/opt/username/lib/nodejs/Seerr/.venv/bin/node -v

• sudo rules. Each account's sudoers file is now written root-owned and read-only (0440), checked with visudo before it is put in place, and repaired on every update. Each account gets its own unique alias, and an account with a dot in its name gets a file that sudo actually reads, because sudo skips files with a dot in their name.
• ruTorrent and rTorrent. Each account's ruTorrent profile folder is now closed to the other accounts, and .rtorrent.rc is no longer world-readable (0660). Updates apply both to existing accounts. The ruTorrent update also keeps its temporary backup in a private folder and deletes the copy older updates left behind.
• The dashboard's own account. It no longer joins each account's private Emby and Jellyfin group, and the update removes that membership where an older version added it. The dashboard still reads app folders through the shared QuickBox group, so nothing you see changes.

Until now, every account you created got rTorrent, ruTorrent and AutoDL whether that person wanted them or not: a running rTorrent service, its config, its folders, a web route and a dashboard row, for every new user. On a server where most people use qBittorrent or Transmission, or only stream, that was a service per account doing nothing.

New accounts now start clean. qb user create and dashboard account creation no longer set up rTorrent, ruTorrent or AutoDL. An account that wants rTorrent installs it like any other app, from Package Management or with:

qb install rtorrent -u username
qb install rutorrent -u username

Accounts that already have rTorrent keep it exactly as it is. This only changes what a new account starts with.

rTorrent and ruTorrent now follow the account. They work the same way as qBittorrent, Transmission and Deluge. The rTorrent and libtorrent packages are installed once for the whole server and shared. When the next account installs rTorrent, nothing is compiled or downloaded again. QuickBox only stages what belongs to that account:

• its own ~/.rtorrent.rc, with its own randomly picked port range
• its ~/torrents/rtorrent folders for downloads, sessions, logs and watch folders
• its own rtorrent@username service and Unix socket
• its own nginx route, so its ruTorrent talks to its rTorrent and nobody else's
• its row in the App Dashboard

ruTorrent is the same. The application itself, with its PHP pool, nginx config, plugins and the club-QuickBox theme, is installed once by the first account. Every later account gets only its own ruTorrent config pointing at its own rTorrent. Installing ruTorrent for an account that doesn't have rTorrent yet adds rTorrent first, and ruTorrent plugins only start for accounts that actually have ruTorrent.

It works in reverse too:

• Remove takes away only that account's rTorrent and its ruTorrent, and keeps its finished downloads. The shared packages go only when the last account that uses rTorrent removes it.
• Reinstall rebuilds only that account's setup, on the server's version.
• Update stays with administrators and moves every account that has rTorrent together. Accounts without it are skipped.

If you have been running QuickBox for a while, most of your accounts probably have rTorrent because account creation used to force it on them. Here is what the update does, and does not do:

• Nothing is taken away. Every account that has rTorrent or ruTorrent today keeps it, with its own config, port range, download folder, settings and torrents. The update does not remove rTorrent from anyone.
• Each account's rTorrent is now its own. rTorrent and ruTorrent stop being server-wide apps in the catalog and the dashboard. In Package Management, a user whose group allows rTorrent installs, reinstalls and removes it for their own account only.
• You can clean up accounts that never wanted it. If an account only has rTorrent because it was forced on, remove it from just that account. That also removes the account's ruTorrent. Its downloads are kept, and every other account keeps running untouched:

qb remove rtorrent -u username

• Existing accounts get the tighter permissions. .rtorrent.rc is closed to other accounts (0660) when rTorrent is installed, reinstalled or updated, each account's ruTorrent profile folder is locked down on every QuickBox update, and the next rTorrent update makes ruTorrent's plugins start only for accounts that actually use ruTorrent.

rTorrent, ruTorrent, qBittorrent, Transmission and Deluge all run from one shared program now, so they share one set of rules:

• One version per server. Installs and reinstalls use the version the server already runs. Asking for a different one with -o is refused before anything changes. Only an administrator's update moves the server to another version, and it moves every account that has the client together. qb update deluge -u username is administrator-only now too.
• The first install is an administrator's call. On a server that doesn't have the client yet, a regular user sends a request instead (see below).
• Updates are administrator-only. So are reinstalling or removing it from the last account that uses it, so one user can never pull ruTorrent or rTorrent out from under everyone else.
• One software job at a time. Overlapping installs, updates and removals now wait in line behind one lock instead of running over each other, and asking twice to install an app an account already has is refused with a message that names the app and the account.

rTorrent, ruTorrent, qBittorrent, Transmission and Deluge are shared by every account, so the first install on a server is an administrator's call. Until now a regular user simply couldn't install one. Now they can ask.

When the server doesn't have the client yet, a regular user sees Request install on its card in Package Management. After sending it, the card reads Requested, with Cancel request while it is waiting, and they are notified when it is approved or denied.

Every administrator is notified of a new request. Package Management then shows an Install requests table with the account, the application and when it was asked for. Install opens the normal install dialog for that account, so you pick the server's version right there, or Deny it. Approving a ruTorrent request takes care of rTorrent as well. Once the client is on the server, other accounts install it directly on the server's version, no request needed.

ruTorrent has had club-QuickBox for a while. Now Transmission has its own match. Its web interface is a complete rewrite: it looks and behaves like your QuickBox dashboard, follows the theme you pick there, and works on everything from a phone to a wide desktop.

Spectre	Smoked
Reel	Light

What you get:

• Four themes that follow your dashboard: Spectre, Smoked, Reel, and Light (the dashboard's Default theme). A palette button overrides it for one browser.
• A list that stays fast with thousands of torrents. Sort by any column, pick your columns, and choose comfortable or compact rows.
• Sidebar filters for status, labels, trackers and folders with live counts, and search on Ctrl K.
• A details drawer with General, Files, Trackers, Peers and Options: file priorities, renaming, tracker editing, and per-torrent limits and seeding rules.
• Add by file, magnet link or drag and drop, with the free space shown before you start.
• Every daemon setting in one Settings dialog, showing only the settings your Transmission actually supports.
• Keyboard and screen reader friendly. The list is a real grid with arrow keys, ranges and shortcuts, and every control has a name.
• Seven complete languages: English, Danish, German, Spanish, French, Brazilian Portuguese and Simplified Chinese. It follows your dashboard language.

On a phone the list turns into cards and details open full screen.

Torrent list	Details

It is also safer than what it replaces. Torrent names, tracker messages and peer details are always shown as plain text, and the interface talks to your Transmission and nothing else. The old update check, the third-party peer IP lookup and the outside links are gone.

Getting it. New Transmission installs get it automatically, from a checksum-verified release. If Transmission is already on your server, an administrator runs this once:

qb update transmission -u username

Every later Transmission update keeps it current. If you ever want Transmission's own interface back, it is still there as index.original.html in the same folder, and the About dialog links to it.

Free for everyone. The interface is open source under the MIT license at QuickBox/transmission-web-control, built on Transmission Web Control. It works with any Transmission from 2.94 to 4.1, QuickBox or not, and the README has the install steps for other servers.

• Usernames with a dot in them work everywhere now: sudo, the dashboard's account checks, and qb user create.
• Creating an account refuses a name the system already uses, such as a service account, in the CLI and in dashboard registration.
• If an account create stops part way, QuickBox removes what it had made instead of leaving half an account behind.

If you moved your QuickBox database to MariaDB with qb manage db -o mysql, this release fixes the conversion and repairs earlier ones.

• Long text values are no longer cut to 255 characters. Only indexed text columns get a length limit, the import runs in strict mode, and the conversion compares row counts and text lengths and reverts if anything doesn't match. It also refuses a target database that isn't empty.
• Converted before this fix? Updating repairs it automatically: values that were cut are restored from the backup the conversion kept.
• Dates are converted properly, and zero dates left by an earlier conversion are repaired. Converting back to SQLite also writes dates the way the dashboard's date filters expect.
• Foreign keys are created after the indexes, so the conversion no longer stops on them.
• Every query the CLI runs now works the same on SQLite and MariaDB, including Delete Protection's counter.

• Secrets kept off command lines. Passwords, license keys and tokens that QuickBox hands to the tools it runs (updates, license checks, database commands, Plex, FileBot, rclone, Nextcloud, Ombi, phpMyAdmin, Redis and the dashboard's installs) now go on standard input or through the environment instead of as command arguments, so they stay out of process listings and command logs. The dashboard also stopped writing secret install values into its package job files; those files are private to the dashboard now, and finished jobs are removed after seven days.
• Safer updates. The app catalog is checked before an update replaces it, so a missing catalog file can never empty it. The new shell library goes in right after the update swaps the files. A rolled-back dashboard update now also restores its helpers, sudo rules and D-Bus policy and restarts the transfer service on the restored release. The ruTorrent plugin store is kept across updates.
• ruTorrent and phpMyAdmin reload their PHP after an update, so the first page you open runs the new code, not a cached copy of the old one.
• club-QuickBox updates show up faster. The Theme badge checks for a new release every 10 minutes and on startup, so it appears without restarting the dashboard.
• Nextcloud sets the admin password exactly as you typed it, even with spaces at the start or end.
• Transmission 4 installs without a wall of harmless warnings, no longer pulls a package that conflicts on Ubuntu 24.04, and removing it purges the package cleanly.
• Servers set to a comma-decimal language like German send valid status data again.
• Translations. German, Danish, Spanish, French and Portuguese CLI and update messages have their accents back, and every new message in this release reads in all seven languages.

• Updating QuickBox
• Package Management and install requests
• Transmission
• rTorrent, per-account setup
• ruTorrent
• User management in the CLI
• Database management with qb manage

Related: club-QuickBox: The Default ruTorrent Skin, Rebuilt.