fix(ui): bump Node to 24.22.1 to patch the October 2026 security release (#13126)

.grype.yaml

@@ -80,15 +80,16 @@ ignore:
     package:
       name: python
 
-  # zlib in the Alpine base images of the UI (node:24.18.1-alpine) and MCP
-  # (python:3.13.14-alpine3.23) containers. CVE-2026-85091 is a heap overflow in
-  # gz_vacate() reached only through non-blocking gzwrite() followed by gzprintf() after
-  # a write stall. Node links its own bundled zlib and the MCP server never writes gzip
-  # files, so neither image calls that path. TEMPORARY: the 1.3.2-r1 fix is in the
-  # Alpine index and could be taken with `apk add --upgrade`, but we wait for the base
-  # images to ship it instead (the newest node:24-alpine and python:3.13-alpine3.23 still
-  # carry 1.3.2-r0). Pinned to that version so the rule stops matching on its own once a
-  # base image moves forward. Remove when the base digests are bumped, by 2026-11-07.
+  # zlib in the Alpine base image of the MCP (python:3.13.16-alpine3.23) container.
+  # CVE-2026-85091 is a heap overflow in gz_vacate() reached only through non-blocking
+  # gzwrite() followed by gzprintf() after a write stall; the MCP server never writes
+  # gzip files, so the image never calls that path. The UI image no longer needs this:
+  # node:24.22.1-alpine is built on Alpine 3.24 and ships 1.3.2-r1. TEMPORARY: the fix
+  # landed in the 3.23 index on 2026-10-06, two days after the pinned python image was
+  # built, and could be taken with `apk add --upgrade`, but we wait for the base image
+  # to ship it instead (python:3.13.17-alpine3.23, built 2026-10-22, already does).
+  # Pinned to that version so the rule stops matching on its own once the base image
+  # moves forward. Remove when the MCP digest is bumped, by 2026-11-07.
   # https://security.alpinelinux.org/vuln/CVE-2026-85091
   - vulnerability: CVE-2026-85091
     package:

ui/.nvmrc

@@ -1 +1 @@
-24.18.1
+24.22.1

ui/Dockerfile

@@ -1,5 +1,5 @@
 # Keep in sync with ui/.nvmrc.
-FROM node:24.18.1-alpine@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3 AS base
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS base
 
 LABEL maintainer="https://github.com/prowler-cloud"
 
@@ -7,25 +7,9 @@ LABEL maintainer="https://github.com/prowler-cloud"
 # the bundled-npm CVE surface from every stage, incl. prod.
 # No blanket apk upgrade: it resolves against Alpine's live repo, so the digest pin
 # above would not make the image reproducible. Move the digest forward instead, or
-# take a named package as the targeted exception below.
+# take a named package as a targeted, commented exception.
 RUN corepack enable && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
-# High CVEs fixed in Alpine 3.24 but not yet in the pinned base image:
-#   libcrypto3/libssl3 3.5.8-r0  CVE-2026-14456, CVE-2026-14457, CVE-2026-18798,
-#                                CVE-2026-54874, CVE-2026-63072, CVE-2026-63075,
-#                                CVE-2026-63076  (image ships 3.5.7-r0)
-# The base image pins node 24.18.1, which has not been rebuilt since that package
-# was published, so the upgrade is taken here rather than by moving the pin -- the
-# newest published node:24-alpine (24.19.0, built 2026-08-03) predates the
-# 2026-08-13 advisory and carries the same vulnerable version. libcrypto3 and
-# libssl3 are both built from openssl and are flagged separately, so both are named.
-# `>=` rather than `=`: Alpine keeps only the newest build of a package in a
-# branch's index, so an exact pin breaks this build the day 3.5.8-r0 is superseded.
-# Drop this once the base image ships 3.5.8-r0 or later.
-RUN apk add --no-cache --upgrade \
-    "libcrypto3>=3.5.8-r0" \
-    "libssl3>=3.5.8-r0"
-
 # Install dependencies only when needed
 FROM base AS deps
 # Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.

ui/changelog.d/node-24.22.1-bump.security.md

@@ -0,0 +1 @@
+Node.js from 24.18.1 to 24.22.1 LTS in the UI container image and `.nvmrc`, patching the eight CVEs of the October 2026 security release that affect the 24.x line, including the Brotli decoder remote code execution (CVE-2026-111497); the base image moves to Alpine 3.24, so the targeted `libcrypto3` / `libssl3` upgrade is no longer needed