Repository navigation
Conversation
1 task
Both builder and runtime stages used the floating node:24-alpine tag, so images could be built on a Node.js release vulnerable to the October 2026 security release issues (incl. CVE-2026-111497, Brotli decoder OOB write). Pin both stages to node:24.22.1-alpine3.24 by multi-arch index digest via a single NODE_IMAGE build arg. Refs evolution-foundation#2761 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CPViW4Kzn5aFydKQgfV3yq
nogara
force-pushed
the
fix/node-24.22.1-security-2761
branch
from
October 23, 2026 16:35
fa78d0a to
f698d12
Compare
nogara
added a commit
to nogara/evolution-api
that referenced
this pull request
Oct 23, 2026
Both stages used the floating node:24-alpine tag, so an image built before the base was refreshed keeps a Node.js release affected by the October 2026 security release (including CVE-2026-111497, a Brotli decoder out-of-bounds write reachable through axios media downloads). Rebuilding an old commit could also pick a different Node.js than the one it was tested on. Pin both stages through one NODE_IMAGE build arg to node:24.22.1-alpine3.24 at its multi-arch index digest (amd64 and arm64). Bumping Node.js is now an explicit change, and --build-arg NODE_IMAGE=... still allows an override. Upstream: evolution-foundation#2761 / evolution-foundation#2765 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CPViW4Kzn5aFydKQgfV3yq
MatiasxVarela
pushed a commit
to purple-dice/evolution-in-purple
that referenced
this pull request
Oct 23, 2026
Both stages used the floating node:24-alpine tag, so an image built before the base was refreshed keeps a Node.js release affected by the October 2026 security release (including CVE-2026-111497, a Brotli decoder out-of-bounds write reachable through axios media downloads). Rebuilding an old commit could also pick a different Node.js than the one it was tested on. Pin both stages through one NODE_IMAGE build arg to node:24.22.1-alpine3.24 at its multi-arch index digest (amd64 and arm64). Bumping Node.js is now an explicit change, and --build-arg NODE_IMAGE=... still allows an override. Upstream: evolution-foundation#2761 / evolution-foundation#2765 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CPViW4Kzn5aFydKQgfV3yq
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses #2761.
Both Dockerfile stages (
builderandfinal) used the floatingnode:24-alpinetag. Images built before the upstream base was refreshed stay on a Node.js release affected by the October 2026 security release, including CVE-2026-111497 (Brotli decoder out-of-bounds write). The Baileys media download path usesaxios, whose Node HTTP adapter can decompress Brotli responses from external URLs.This PR pins both stages to the patched Node.js 24 LTS image:
node:24.22.1-alpine3.24sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53linux/amd64(sha256:1200d815…) andlinux/arm64/v8(sha256:398bcf38…)A single
NODE_IMAGEbuild arg defines the image, so both stages stay in sync. You can override it with--build-arg NODE_IMAGE=...when needed.Notes for maintainers / operators
NODE_IMAGE. This is intentional: builds become reproducible.docker compose pullon existing tags does not update Node.js until a patched image is published.docker run --rm --entrypoint node <image> -v. The expected output isv24.22.1.Not covered here (from the issue checklist)
amd64/arm64images and documenting digests. This needs release pipeline access.Test plan
docker buildx build --platform linux/amd64,linux/arm64 .succeedsnode -vinside the built image reportsv24.22.1I did not build the image locally, because the Docker daemon was not available.
🤖 Generated with Claude Code
https://claude.ai/code/session_01CPViW4Kzn5aFydKQgfV3yq