Repository navigation
chore(deps): bump Node.js to 24.22.1 to fix CVE-2026-111497 - #6560
ludoviccarretti wants to merge 1 commit into
Conversation
Upgrade Node.js runtime across .nvmrc, build/test Dockerfiles and CI test configurations from 24.16.0/22.22.0 (Alpine) to 24.22.1-alpine. Addresses CVE-2026-111497 fixed in this release.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2e907e28ea
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -1 +1 @@ | |||
| 24.16.0 | |||
| 24.22.1 | |||
There was a problem hiding this comment.
For packaged desktop builds, this .nvmrc only selects the build-time Node used by install-all-build-libs; the app is still shipped with electron@43.7.1 (package.json:188) and starts the backend inside that Electron main process (redisinsight/desktop/app.ts:38 and redisinsight/desktop/src/lib/server/server.ts:14), so it never runs either patched Docker runtime. A desktop user whose backend receives a crafted Brotli-compressed response therefore remains on Electron's vulnerable embedded Node/Brotli despite this CVE fix; bump Electron to a release carrying the Node fix and regenerate its lock entry as part of this change.
AGENTS.md reference: AGENTS.md:L116-L116
Useful? React with 👍 / 👎.
|
|
Picks up the latest Node 24 and Electron 43 patch releases on top of the CVE-2026-111497 bump. Node 24.22.2 keeps the base image free of the compromised eMudhra root and ships npm with tar 7.5.22. References: #6560, #6556, #6450
|
Thanks for the contribution! I'm closing this one in favour of #6584 |
Picks up the latest Node 24 and Electron 43 patch releases on top of the CVE-2026-111497 bump. Node 24.22.2 keeps the base image free of the compromised eMudhra root and ships npm with tar 7.5.22. References: #6560, #6556, #6450
* chore(deps): bump Node.js to 24.22.1 and Electron to 43.8.4 Pins Node 24.22.1 in .nvmrc and the build/test Dockerfiles, and bumps Electron to 43.8.4 so the desktop app bundles Node 24.22.1 as well. * chore(deps): bump Node.js to 24.22.2 and Electron to 43.8.7 Picks up the latest Node 24 and Electron 43 patch releases on top of the CVE-2026-111497 bump. Node 24.22.2 keeps the base image free of the compromised eMudhra root and ships npm with tar 7.5.22. References: #6560, #6556, #6450
What
Bumps the Node.js runtime to 24.22.1 across
.nvmrc, the build/test Dockerfiles, and CI test configurations to address CVE-2026-111497 (a.k.a. "Node2Shell").Why this matters: CVE-2026-111497 is an out-of-bounds write (CWE-787) in the Brotli decoder bundled into the Node.js binary. Node.js rates it high severity (CVSS v4.0 9.2 / Critical in some scores), and it can allow:
Any untrusted Brotli-compressed input triggers it — not only explicit
zlibcalls, but also transparentfetch()responses withContent-Encoding: brand body-parsing middleware. Public PoCs exist (code execution demonstrated against the unpatchednode:24.22.0image), so this is a routine-but-urgent fix.Change: every Node base image / version pin is upgraded to the patched
24.22.1-alpine(the fixed version for the 24.x line):.nvmrc:24.16.0→24.22.1Dockerfile,.github/build/build.Dockerfile,redisinsight/api/test/test-runs/**,tests/e2e/static-server.Dockerfile:node:24.16.0-alpine/node:22.22.0-alpine→node:24.22.1-alpineRefs https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Testing
No code logic changes — this is a base-image / runtime version bump. Verified:
npm run build+npm run test:apipass on Node 24.22.1 locallypackage.jsontouched, so nopackage-lock.jsonchurnnode:24.22.1-alpinetag (rebuild/redeploy required — an image still pinned to a previous tag stays vulnerable)No visual/behavioral changes expected; a standard smoke test of the app on the new runtime is sufficient.
Note
Medium Risk
Touches the production and test Node runtime only (no app logic), but a full image rebuild/redeploy is required and any Node patch can surface subtle runtime regressions despite passing existing build/tests.
Overview
Upgrades every Node.js version pin to 24.22.1 to pick up the security fix for CVE-2026-111497 (Brotli decoder out-of-bounds write in the Node binary, with DoS / memory disclosure / RCE risk on untrusted Brotli input).
.nvmrcmoves from24.16.0to24.22.1. Production and CI Docker (Dockerfilebuild + runtime stages,.github/build/build.Dockerfile, API testtest.Dockerfile, e2estatic-server.Dockerfile) now usenode:24.22.1-alpineinstead of24.16.0-alpineor22.22.0-alpine. Test compose dummy services (local.build.yml,cloud-st/docker-compose.yml) are updated to the same image so local/CI test stacks match the patched runtime.No application or dependency manifest changes—only base images and the local Node version file. Images must be rebuilt and redeployed for the fix to apply in running environments.
Reviewed by Cursor Bugbot for commit 2e907e2. Bugbot is set up for automated code reviews on this repo. Configure here.