fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell) #41

wtclaude · 2026-10-26T10:02:02-05:00

wtclaude commented

2026-10-26 10:02:02 -05:00

What & why

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's bundled Brotli decoder. It was fixed on 2026-10-21 in 22.23.4. Both image stages used the floating node:22-bookworm-slim tag; the copy cached on the build host was four weeks old, i.e. from before the fix. This pins node:22.23.4-bookworm-slim in both stages and in PR checks, and the README prerequisite now names the patched floor.

Exposure is low on its own: Astro's Node adapter doesn't decode Content-Encoding on requests, and the server makes no outbound fetches at runtime. The upgrade is still needed because the runtime itself was unpatched. Companion: website#226.

How it was tested

docker build . succeeds; node --version inside the image prints v22.23.4.

Checklist

I have read CONTRIBUTING.md.
The change builds and existing tests/checks pass locally.
I have added or updated tests/docs where it makes sense.
My commits are reasonably scoped with clear messages.

AI-assisted contributions (required)

No AI tools were used to produce this contribution.
AI tools were used. Tool(s): Claude Code (Claude Opus 5.5). I have reviewed and understand
every change, and take responsibility for it. AI-authored commits are
marked with a Co-Authored-By / Assisted-By trailer.

License

I agree that my contribution is licensed under this project's license
(GNU GPL v3.0 or later), and I have the right to contribute it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

## What & why CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's bundled Brotli decoder. It was fixed on 2026-10-21 in 22.23.4. Both image stages used the floating `node:22-bookworm-slim` tag; the copy cached on the build host was four weeks old, i.e. from before the fix. This pins `node:22.23.4-bookworm-slim` in both stages and in PR checks, and the README prerequisite now names the patched floor. Exposure is low on its own: Astro's Node adapter doesn't decode `Content-Encoding` on requests, and the server makes no outbound fetches at runtime. The upgrade is still needed because the runtime itself was unpatched. Companion: website#226. ## How it was tested - `docker build .` succeeds; `node --version` inside the image prints `v22.23.4`. ## Checklist - [x] I have read [CONTRIBUTING.md](CONTRIBUTING.md). - [x] The change builds and existing tests/checks pass locally. - [x] I have added or updated tests/docs where it makes sense. - [x] My commits are reasonably scoped with clear messages. ## AI-assisted contributions (required) - [ ] No AI tools were used to produce this contribution. - [x] AI tools were used. Tool(s): `Claude Code (Claude Opus 5.5)`. I have reviewed and understand every change, and take responsibility for it. AI-authored commits are marked with a `Co-Authored-By` / `Assisted-By` trailer. ## License - [x] I agree that my contribution is licensed under this project's license (**GNU GPL v3.0 or later**), and I have the right to contribute it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-10-26 10:02:03 -05:00

fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell)

PR checks / checks (pull_request) Failing after 2m24s

Details

d59c993430

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Node's
bundled Brotli decoder, fixed on 2026-10-21 in 22.23.4. The image used
the floating node:22-bookworm-slim tag, so a cached or stale base could
still carry an older 22.x. Pin the patched version in both stages and in
the PR checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-10-27 12:37:53 -05:00

chore(facts): Module API 1.19.0, Module-Rust v0.6.0

PR checks / checks (pull_request) Successful in 5m58s

Details

e7bbc250a5

checkFacts turned this PR red on drift from the demo-mode merges, not on
the Node change: website main is at MODULE_API 1.19.0, Module-Rust main
declares coreApi ^1.19.0, and Module-Rust released v0.6.0. Every page
reads the three values from platform.json; verifiedOn moves to today.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

whitlocktech merged commit 8701126d64 into main

2026-10-27 12:49:08 -05:00

whitlocktech deleted branch fix/node22-node2shell

2026-10-27 12:49:08 -05:00

whitlocktech referenced this issue from a commit

2026-10-27 12:49:09 -05:00

Merge pull request 'fix(docker): pin Node 22.23.4 for the image and CI (Node2Shell)' (#41) from fix/node22-node2shell into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/runicgateway.com#41