From b9e70a0981950226e6de1ea5111189db751a15d0 Mon Sep 17 00:00:00 2001
From: Julian Knutsen <julianknutsen@users.noreply.github.com>
Date: Thu, 5 Nov 2026 04:31:05 +0000
Subject: [PATCH] fix(security): Node 22.23.4 base pinned by digest; protobufjs
 6.11.6

Move both Node stages of docker/hyperdx/Dockerfile (node_base, prod) from
the floating node:22.22-alpine tag (resolved to 22.22.3) to
node:22.23.4-alpine3.24, pinned to the multi-arch index digest
sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914.

Node 22.23.4 fixes CVE-2026-111497 (Brotli decoder out-of-bounds write,
CVSS 9.2, CISA KEV 2026-10-27, actively exploited) and CVE-2026-105481,
-105482, -106069, -106072, -106073, -106074 (HTTP agent reuse, DNS NUL
truncation, TLS hostname verification, crypto caches). The new base also
moves Alpine 3.24.1 -> 3.24.3 (libssl3/libcrypto3 3.5.7 -> 3.5.9, musl,
zlib), clearing 23 OS-package findings including HIGH CVE-2026-14456.

Resolve @hyperdx/otel-web-session-recorder's protobufjs ~6.11.2 to
~6.11.6 (6.11.4 -> 6.11.6) for CVE-2026-41242 / GHSA-xq3m-2v4x-88gg.
The recorder only imports protobufjs/minimal, so the browser bundle is
byte-identical; this clears the lockfile finding.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docker/hyperdx/Dockerfile | 11 ++++++++---
 package.json              |  3 ++-
 yarn.lock                 |  8 ++++----
 3 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/docker/hyperdx/Dockerfile b/docker/hyperdx/Dockerfile
index 6a3321822a..6ffb331ad4 100644
--- a/docker/hyperdx/Dockerfile
+++ b/docker/hyperdx/Dockerfile
@@ -7,7 +7,12 @@
 # - Mongo
 # - Otel Collector (otelcol)
 
-ARG NODE_VERSION=22.22
+# Pinned by digest: the multi-arch index of node:22.23.4-alpine3.24 (Node security
+# release for CVE-2026-111497 Brotli, plus the 22.23.4 TLS/DNS fixes). Bump
+# NODE_VERSION and NODE_DIGEST together; get the digest with
+# `crane digest node:<version>-alpine3.24`.
+ARG NODE_VERSION=22.23.4
+ARG NODE_DIGEST=sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914
 ARG CLICKHOUSE_VERSION=26.8
 ARG OTEL_COLLECTOR_VERSION=0.155.0
 ARG OTEL_COLLECTOR_CORE_VERSION=1.61.0
@@ -42,7 +47,7 @@ RUN go mod download
 COPY packages/otel-collector/ ./
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /migrate ./cmd/migrate
 
-FROM node:${NODE_VERSION}-alpine AS node_base
+FROM node:${NODE_VERSION}-alpine3.24@${NODE_DIGEST} AS node_base
 
 WORKDIR /app
 
@@ -104,7 +109,7 @@ RUN --mount=type=cache,target=/root/.yarn/berry/cache,id=yarn-cache \
 
 
 # prod ############################################################################################
-FROM node:${NODE_VERSION}-alpine AS prod
+FROM node:${NODE_VERSION}-alpine3.24@${NODE_DIGEST} AS prod
 
 LABEL org.opencontainers.image.vendor="HyperDX" \
       org.opencontainers.image.title="HyperDX Production" \
diff --git a/package.json b/package.json
index 6659ab07d9..26f0a2d198 100644
--- a/package.json
+++ b/package.json
@@ -86,7 +86,8 @@
     "on-headers": "^1.1.0",
     "fast-xml-parser": "^4.5.6",
     "systeminformation": "^5.24.0",
-    "@asyncapi/specs": "6.11.1"
+    "@asyncapi/specs": "6.11.1",
+    "@hyperdx/otel-web-session-recorder/protobufjs": "~6.11.6"
   },
   "resolutionsNotes": {
     "@stryker-mutator/core/minimatch": "Dev tooling, not a CVE override. Added when a blanket `brace-expansion` pin forced v2 (CJS) while minimatch v10 needs v5's named exports. That blanket pin is gone — it broke `nx affected` the same way — so brace-expansion now resolves per consumer and Stryker would most likely work on minimatch v10. The pin stays because no CI job runs `yarn dev:mutation`, so nothing would catch it if that guess is wrong. Drop it once someone has run the mutation suite on v10. See CONTRIBUTING.md#mutation-tests."
diff --git a/yarn.lock b/yarn.lock
index 3df33950e2..1af4d01d09 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -25965,9 +25965,9 @@ __metadata:
   languageName: node
   linkType: hard
 
-"protobufjs@npm:~6.11.2":
-  version: 6.11.4
-  resolution: "protobufjs@npm:6.11.4"
+"protobufjs@npm:~6.11.6":
+  version: 6.11.6
+  resolution: "protobufjs@npm:6.11.6"
   dependencies:
     "@protobufjs/aspromise": "npm:^1.1.2"
     "@protobufjs/base64": "npm:^1.1.2"
@@ -25985,7 +25985,7 @@ __metadata:
   bin:
     pbjs: bin/pbjs
     pbts: bin/pbts
-  checksum: 10c0/c244d7b9b6d3258193da5c0d1e558dfb47f208ae345e209f90ec45c9dca911b90fa17e937892a9a39a4136ab9886981aae9efdf6039f7baff4f7225f5eeb9812
+  checksum: 10c0/a7ed63a75b86c7d22abdfef48e9775f373befbaad4beceadf5bd047066365d735386d57851b35f89ae2c1afdea2da1c93a17682aa9a4a8f3df7ca54ccdce309b
   languageName: node
   linkType: hard