[8bittitan]

Why

Node.js published security releases on October 21, 2026 (advisory). We're on 22.15.0, which is missing fixes for these CVEs that affect the 22.x line:

• High
  • CVE-2026-105482: dns.resolve*() truncates hostnames containing a NUL byte
  • CVE-2026-106069: TLS cert check can validate a different IP than the one connected to (leading-zero IPv4)
  • CVE-2026-111497: Brotli decoder out-of-bounds write, which can lead to RCE
• Medium
  • CVE-2026-105481: HTTP keep-alive socket can accept a response written before the request
  • CVE-2026-106072: DNS SAN can authenticate non-canonical IPv4 hostnames
  • CVE-2026-106074: crypto.randomUUID() and randomInt() entropy cache repeats values in snapshots
• Low
  • CVE-2026-106073: Permission Model bypass via fs.realpathSync

The DNS, TLS and keep-alive ones matter most for us. Renderscript fetches arbitrary customer URLs, and we rely on hostname checks for that. The Brotli one matters because the service decompresses responses from sites we don't control. Several of these only show up in code paths we may not use, but the 3 high severity ones are worth closing without auditing every call site.

The Docker image was also on a floating node:22-bookworm-slim tag. That meant .nvmrc, engines and the image could drift apart, and a rebuild alone wasn't a reliable way to pick up the patched runtime. Pinning it to 22.23.4 makes the image match what CI tests. It also needs a fix commit, so semantic-release cuts a patch release and builds a new image.

@types/node is bumped to the matching 22.x so the types stay close to the runtime.

Testing

• CI: lint, build and the service readiness check pass on Node 22.23.4
• Build the image locally with yarn docker:build, then run docker run --rm algolia/renderscript node -v. It should print v22.23.4
• Run the image and render a normal page: /render?url=https%3A%2F%2Fwww.algolia.com&ua=Test+Renderscript
• Render a page served with Content-Encoding: br and check it comes back intact
• Render a URL with a non-canonical IP host (for example http://0127.0.0.1). It should be blocked by the DNS filter and not rendered
• After merge, run Release Version with dry_run: true and check it plans 2.3.9. Then run it for real and confirm algolia/renderscript:2.3.9 is pushed and reports Node 22.23.4

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes.}