Repository navigation
Require Node >= 22.23.4 and refuse compressed request bodies (CVE-2026-111497) - #26
Merged
Merged
Conversation
…6-111497) Node.js shipped 22.23.4 / 24.22.1 / 26.12.1 on 2026-10-21 fixing an out-of-bounds write in the Brotli decoder that permits remote code execution when a process decompresses attacker-controlled Brotli data. - Bump "engines.node" to >=22.23.4 in eval/ and agentic-eval/, and add .nvmrc pins so dev and deploy pick up a fixed runtime. - Add eval/lib/rejectCompressedBody.js and call it first in every pages/api route. The routes only accept plain JSON; any non-identity Content-Encoding now gets a 415 before a body parser could ever hand compressed bytes to a decoder. Defense in depth — the Node bump is the actual fix. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011GpAE6VxpgH1p91zKVQC1i
Node 20 is end of life and did not receive the CVE-2026-111497 fix, so CI on 20 was validating against a runtime the package now declares unsupported. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011GpAE6VxpgH1p91zKVQC1i
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Node.js released 22.23.4 / 24.22.1 / 26.12.1 on Oct 21, 2026 for CVE-2026-111497 — an out-of-bounds write in the Brotli decoder reachable by any process that decompresses attacker-controlled Brotli data. The
eval/Next.js app exposes fourpages/apiroutes that accept request bodies from the network, so abr-encoded body is the relevant attack path if this is ever deployed on an unpatched runtime.What
engines.node→>=22.23.4ineval/andagentic-eval/; added.nvmrcpins.eval/lib/rejectCompressedBody.js, called first incases,claude,run-case,run-eval. AnyContent-Encodingother thanidentity→415. The routes only ever accepted plain JSON, so this changes nothing for legitimate clients.Verified
identity→ pass;br/gzip, br→ 415.npm testineval/: 67 pass, 2 fail — the same 2 fail onmaster(missingnode_modules), unrelated.claude.jsCRLF line endings preserved.Still on you
Actually run
node -vwhere this is deployed/developed and update to ≥ 22.23.4.Generated by Claude Code