cloud-hosting-platform/cloud-node-container
6
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Node.js 24 and 26 images; refuse builds below the Oct 2026 security floor #4

Merged
jknapp merged 1 commits from feat/node24-26-security into main 2026-10-22 12:50:51 +00:00
Conversation 0 Commits 1 Files Changed 8
+42 -26
jknapp commented 2026-10-22 12:50:50 +00:00
Owner
Copy link
Copy source

Node.js security release of 2026-10-20/21 (CVE-2026-111497 Brotli out-of-bounds write, plus 9 TLS/DNS/crypto CVEs). Fixed: 22.23.4, 24.22.1, 26.12.1. 18 and 20 are EOL and get no fix.

  • New scripts/install-node.sh <major> replaces the three per-version scripts and fails the build below the per-line security floor, so a lagging NodeSource mirror cannot ship a vulnerable image.
  • CI matrix: 18, 20, 22, 24, 26; fail-fast: false.

Tested locally: node22/24/26 images build and report 22.23.4 / 24.22.1 / 26.12.1. The Brotli fix is a cherry-pick in Node (release notes: deps: brotli: cherry-pick 0ed4268a…), so process.versions.brotli still says 1.1.0/1.2.0 — expected. node24 and node26 containers started as a site (uid 1001) are healthy, nginx answers on :80 and the app on :3000.

🤖 Generated with Claude Code

Node.js security release of 2026-10-20/21 (CVE-2026-111497 Brotli out-of-bounds write, plus 9 TLS/DNS/crypto CVEs). Fixed: **22.23.4, 24.22.1, 26.12.1**. 18 and 20 are EOL and get no fix. - New `scripts/install-node.sh <major>` replaces the three per-version scripts and **fails the build** below the per-line security floor, so a lagging NodeSource mirror cannot ship a vulnerable image. - CI matrix: 18, 20, 22, **24, 26**; `fail-fast: false`. **Tested locally:** node22/24/26 images build and report 22.23.4 / 24.22.1 / 26.12.1. The Brotli fix is a cherry-pick in Node (release notes: `deps: brotli: cherry-pick 0ed4268a…`), so `process.versions.brotli` still says 1.1.0/1.2.0 — expected. node24 and node26 containers started as a site (uid 1001) are healthy, nginx answers on :80 and the app on :3000. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
jknapp added 1 commit 2026-10-22 12:50:50 +00:00
feat: Node.js 24 and 26 images; refuse builds below the Oct 2026 security floor ae6acdd009 
- One install-node.sh <major> replaces install-node{18,20,22}.sh. It fails the
  build if NodeSource hands back a version below the newest security release
  for the line (22.23.4 / 24.22.1 / 26.12.1: CVE-2026-111497 Brotli OOB write
  and 9 others), so a lagging mirror can't ship a vulnerable image silently.
  18 and 20 are EOL: they still build, with a warning.
- CI matrix adds 24 and 26; fail-fast off so one line can't cancel the rest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
jknapp merged commit f1e92ea1b4 into main 2026-10-22 12:50:51 +00:00
jknapp deleted branch feat/node24-26-security 2026-10-22 12:50:51 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
hub-agent Bot jknapp renovate-bot (Renovate Bot) whmcs-sam whp-cicd-user whp-deploy
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: cloud-hosting-platform/cloud-node-container#4