wtclaude
2a6e307f16
CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in the Brotli
decoder Node bundles; it was fixed on 2026-10-21 in 22.23.4, 24.22.1 and
26.12.1. Both images were on node:20-alpine, and Node 20 is past end of
life, so it gets no fix.
The site is not reachable through the main path (Express 4 / body-parser
1.20 refuse a `br` request body with 415, and nothing calls the zlib
Brotli API), but fetch() decodes Brotli responses and the runtime itself
was unpatched. Pin the exact patched version so a floating tag cannot
hold an old build, and run CI on the same version the image ships.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
17 lines
229 B
Docker
17 lines
229 B
Docker
FROM node:22.23.4-alpine
|
|
|
|
WORKDIR /app/bot
|
|
|
|
COPY bot/package*.json ./
|
|
RUN npm install --omit=dev
|
|
|
|
COPY bot/ .
|
|
|
|
RUN mkdir -p /app/bot/logs && chown -R node:node /app/bot/logs
|
|
|
|
USER node
|
|
|
|
EXPOSE 4100
|
|
|
|
CMD ["node", "src/server.js"]
|