Repository navigation
Bump Node.js base image to 22.23.4 (CVE-2026-111497) - #106
Merged
Merged
Conversation
Node.js 22.23.3 bundles a Brotli decoder with an out-of-bounds write (CVE-2026-111497, critical): a crafted `br` stream can corrupt memory, crash the process or potentially execute code. 22.23.4 is the patched release. Both stages were pinned by digest, so a rebuild with --pull could not pick it up; the pin moves to the new image index digest. The image scan did not flag this: Node.js in the official image is installed from a tarball rather than as an OS package, so it is not a package the scanner tracks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7BdieGZH3uKwxq1qMhPEw
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Both
Dockerfilestages (base, L9, andrunner, L34, which runsnode server.js) were onnode:22.23.3-alpine, one patch below the fix for CVE-2026-111497: an out-of-bounds write in the Brotli decoder bundled inside Node.js (critical). A craftedbrstream can corrupt memory, crash the process or potentially execute code.Fix: move both
FROMlines tonode:22.23.4-alpine, pinned by its image index digestsha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914(same pinning convention as before). Because the old pin was a digest, rebuilding with--pullcould not pick up the fix; the Dockerfile had to change.Why the image scan didn't catch it
Node.js in the official image is installed from a tarball, not as an Alpine package, and Brotli is compiled into the
nodebinary. Neither is a package Trivy tracks, so the pre-publish gate passed.npm auditdoesn't cover the runtime either.Risk class
Patch (22.23.3 → 22.23.4, same major/minor line). No code changes.
Test evidence
FROMlines only; no other references to the old version in the repo (grep -rn "22\.23\.3\|0a7108bf").22.23.4-alpine→sha256:fe4f6d74…9914(the old pin0a7108bf…is likewise the22.23.3-alpineindex digest). Node's release index lists v22.23.4 as a security release.testworkflow: green on this PR.docker-publish.ymlruns only on pushes tomainand manual dispatch. Its build and Trivy gate run on merge; check that run before deploying.Generated by Claude Code