Repository navigation
deps: backport Brotli CVE-2026-111497 fix to Node 22.21.1 - #26
Closed
heckerdavid wants to merge 3 commits into
Closed
heckerdavid wants to merge 3 commits into
heckerdavid wants to merge 3 commits into
Conversation
Original commit message: Detect and report invalid stream earlier. PiperOrigin-RevId: 876198329 PR-URL: https://github.com/nodejs-private/node-private/pull/1002 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-111497 (cherry picked from commit 67d2947)
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: https://github.com/nodejs-private/node-private/pull/1002 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> CVE-ID: CVE-2026-111497 (cherry picked from commit a18ec92)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport the published fix for CVE-2026-111497 onto Asana's Node 22.21.1 fork. Invalid Brotli block switches now produce the expected decoder error. The runtime remains 22.21.1; V8, fiber compatibility patches, module ABI 127, and the standard/FIPS Dockerfiles are unchanged.
This includes upstream Node commits 67d294739f and a18ec92752, including the synchronous and streaming regression test. The test-file conflict was resolved by adding only the Brotli regression block, without unrelated tests introduced in intervening upstream releases.
The branch starts from
0f26935ba387. A separate CI commit keeps feature-branch binaries in their Actions run artifacts and prevents them from replacing the shared 22.21.1 GitHub release assets.Validation completed:
src/node_zlib.cc.This is a draft. The full local macOS arm64 runtime build is still running. Runtime regression tests, fiber compatibility checks, Linux x64/arm64 standard and FIPS builds, packaged-runtime smoke tests, and the full upstream test suite remain outstanding.