From 9077fa378e8b5f7994907406af152ac424dd6099 Mon Sep 17 00:00:00 2001 From: chappie-daemon Date: Sat, 24 Oct 2026 09:26:55 -0400 Subject: [PATCH] chore(deps): build and test on Node 24.22.1 for the Brotli decoder fix CVE-2026-111497 is an out-of-bounds write in every Brotli decoder up to 1.2.0. Node bundles its own decoder, so 24.22.1 is the fix on this line. Pin the image digest in both stages instead of floating node:24-alpine, and move .nvmrc so CI tests the same runtime the image ships. --- .changeset/brotli-patched-node.md | 11 +++++++++++ .nvmrc | 2 +- Dockerfile | 4 ++-- 3 files changed, 14 insertions(+), 3 deletions(-) create mode 100644 .changeset/brotli-patched-node.md diff --git a/.changeset/brotli-patched-node.md b/.changeset/brotli-patched-node.md new file mode 100644 index 000000000..7296affbd --- /dev/null +++ b/.changeset/brotli-patched-node.md @@ -0,0 +1,11 @@ +--- +"nostream": patch +--- + +chore(deps): build and test on Node 24.22.1, which patches the Brotli decoder + +CVE-2026-111497 is an out-of-bounds write in every Brotli decoder up to 1.2.0, +reachable by anything that decodes a `br` stream. Node bundles its own decoder, +so the fix is the Node release: 24.22.1 on the 24 line. `.nvmrc` and both +Dockerfile stages move from floating `node:24-alpine` to a pinned +`node:24.22.1-alpine`. diff --git a/.nvmrc b/.nvmrc index a3b7a31ee..474d750b5 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -v24.14.1 +v24.22.1 diff --git a/Dockerfile b/Dockerfile index 2a40cbfb3..48e3b6817 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ ARG PNPM_VERSION=10.33.0 -FROM node:24-alpine AS build +FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build ARG PNPM_VERSION @@ -14,7 +14,7 @@ COPY . . RUN pnpm build -FROM node:24-alpine +FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 ARG PNPM_VERSION