From d59c9934304e177d60d0dddc396c326d6c03eb69 Mon Sep 17 00:00:00 2001 From: wtclaude Date: Mon, 26 Oct 2026 10:01:49 -0500 Subject: [PATCH] fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell) CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's bundled Brotli decoder, fixed on 2026-10-21 in 22.23.4. The image used the floating node:22-bookworm-slim tag, so a cached or stale base could still carry an older 22.x. Pin the patched version in both stages and in the PR checks. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY --- .gitea/workflows/pr-checks.yml | 2 +- Dockerfile | 4 ++-- README.md | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/pr-checks.yml b/.gitea/workflows/pr-checks.yml index 8fbf471..2ad1be6 100644 --- a/.gitea/workflows/pr-checks.yml +++ b/.gitea/workflows/pr-checks.yml @@ -22,7 +22,7 @@ jobs: - name: Set up Node uses: actions/setup-node@v4 with: - node-version: '22' + node-version: '22.23.4' cache: npm - name: Install diff --git a/Dockerfile b/Dockerfile index 888aca4..9848166 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ # --------------------------------------------------------------------------------------- # Stage 1 — build # --------------------------------------------------------------------------------------- -FROM node:22-bookworm-slim AS build +FROM node:22.23.4-bookworm-slim AS build WORKDIR /build @@ -54,7 +54,7 @@ RUN mkdir -p /split \ # --------------------------------------------------------------------------------------- # Stage 2 — runtime # --------------------------------------------------------------------------------------- -FROM node:22-bookworm-slim AS runtime +FROM node:22.23.4-bookworm-slim AS runtime WORKDIR /app diff --git a/README.md b/README.md index 3054dee..8534169 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ npm run build # → dist/ (prerendered pages + the Node server entry) npm start # serve the built site ``` -Node 22 LTS or newer. Nothing else — no database, no game server, no container runtime. +Node 22.23.4+ (or 24.22.1+); older builds carry the Node2Shell Brotli bug, CVE-2026-111497. Nothing else — no database, no game server, no container runtime. ## Running it in production