Repository navigation
chore(deps): build and test on Node 24.22.1 for the Brotli decoder fix - #968
Merged
Merged
Conversation
CVE-2026-111497 is an out-of-bounds write in every Brotli decoder up to 1.2.0. Node bundles its own decoder, so 24.22.1 is the fix on this line. Pin the image digest in both stages instead of floating node:24-alpine, and move .nvmrc so CI tests the same runtime the image ships.
🦋 Changeset detectedLatest commit: 9077fa3 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
 [Medium impact] The changed code appears safe to merge; no actionable issues were found.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Collaborator
Coverage Report for CI Build 40098185820Coverage remained the same at 75.452%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-111497: an out-of-bounds write in every Brotli decoder up to 1.2.0, CVSS 9.2, reachable by anything that decodes a
brstream — including abrresponse the client never advertised. Node bundles its own decoder, so the fix is the Node release: 24.22.1 on the 24 line.What changed
.nvmrcv24.14.1v24.22.1Dockerfile(build stage)node:24-alpinenode:24.22.1-alpine@sha256:06d7adf…Dockerfile(runtime stage)node:24-alpinenode:24.22.1-alpine@sha256:06d7adf…CI reads
.nvmrcthroughsetup-node, so tests now run on the same runtime the image ships — the old split meant CI verified 24.14.1 and the relay ran whatevernode:24-alpineresolved to.The digest pin matters as much as the version: a floating tag makes the runtime an accident of build time, which is how the vulnerable 24.22.0 stayed in the published agent image.
Verification
node:24.22.1-alpineresolves on Docker Hub assha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53. The relay's own wire behaviour is untouched — this changes only the runtime that executes it.Worth noting for reviewers:
libbrotli1in the base image has no patched Ubuntu package yet, so anything linking the system library (curl in a build stage) is still exposed. Node and Bun carry their own decoder, which is why the runtime pin is the whole fix here.