From f698d12b728046357f876703c7eda447e973991f Mon Sep 17 00:00:00 2001 From: Luiz Gustavo Nogara Date: Fri, 23 Oct 2026 12:09:48 -0300 Subject: [PATCH] fix(docker): pin Node.js to patched 24.22.1 for October 2026 CVEs Both builder and runtime stages used the floating node:24-alpine tag, so images could be built on a Node.js release vulnerable to the October 2026 security release issues (incl. CVE-2026-111497, Brotli decoder OOB write). Pin both stages to node:24.22.1-alpine3.24 by multi-arch index digest via a single NODE_IMAGE build arg. Refs #2761 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01CPViW4Kzn5aFydKQgfV3yq --- Dockerfile | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 81953db4ff..e4b2205550 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,8 @@ -FROM node:24-alpine AS builder +# Pinned to a patched Node.js 24 LTS release (October 2026 security release, +# CVE-2026-111497). Keep tag and digest in sync when bumping. +ARG NODE_IMAGE=node:24.22.1-alpine3.24@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 + +FROM ${NODE_IMAGE} AS builder RUN apk update && \ apk add --no-cache git ffmpeg wget curl bash openssl @@ -43,7 +47,7 @@ ENV LICENSE_ENDPOINT_XOR_KEY=${LICENSE_ENDPOINT_XOR_KEY} RUN NODE_OPTIONS="--max-old-space-size=2048" npm run build -FROM node:24-alpine AS final +FROM ${NODE_IMAGE} AS final RUN apk update && \ apk add tzdata ffmpeg bash openssl