From f26b9776d416dd9846e5edff9ba57cd79341ff18 Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Thu, 22 Oct 2026 14:28:46 +0200
Subject: [PATCH] fix(ui): bump Node to 24.22.1 to patch the October 2026
 security release (#13126)

---
 .grype.yaml                                  | 19 ++++++++++---------
 ui/.nvmrc                                    |  2 +-
 ui/Dockerfile                                | 20 ++------------------
 ui/changelog.d/node-24.22.1-bump.security.md |  1 +
 4 files changed, 14 insertions(+), 28 deletions(-)
 create mode 100644 ui/changelog.d/node-24.22.1-bump.security.md

diff --git a/.grype.yaml b/.grype.yaml
index 18345342e8..2981aca12e 100644
--- a/.grype.yaml
+++ b/.grype.yaml
@@ -80,15 +80,16 @@ ignore:
     package:
       name: python
 
-  # zlib in the Alpine base images of the UI (node:24.18.1-alpine) and MCP
-  # (python:3.13.14-alpine3.23) containers. CVE-2026-85091 is a heap overflow in
-  # gz_vacate() reached only through non-blocking gzwrite() followed by gzprintf() after
-  # a write stall. Node links its own bundled zlib and the MCP server never writes gzip
-  # files, so neither image calls that path. TEMPORARY: the 1.3.2-r1 fix is in the
-  # Alpine index and could be taken with `apk add --upgrade`, but we wait for the base
-  # images to ship it instead (the newest node:24-alpine and python:3.13-alpine3.23 still
-  # carry 1.3.2-r0). Pinned to that version so the rule stops matching on its own once a
-  # base image moves forward. Remove when the base digests are bumped, by 2026-11-07.
+  # zlib in the Alpine base image of the MCP (python:3.13.16-alpine3.23) container.
+  # CVE-2026-85091 is a heap overflow in gz_vacate() reached only through non-blocking
+  # gzwrite() followed by gzprintf() after a write stall; the MCP server never writes
+  # gzip files, so the image never calls that path. The UI image no longer needs this:
+  # node:24.22.1-alpine is built on Alpine 3.24 and ships 1.3.2-r1. TEMPORARY: the fix
+  # landed in the 3.23 index on 2026-10-06, two days after the pinned python image was
+  # built, and could be taken with `apk add --upgrade`, but we wait for the base image
+  # to ship it instead (python:3.13.17-alpine3.23, built 2026-10-22, already does).
+  # Pinned to that version so the rule stops matching on its own once the base image
+  # moves forward. Remove when the MCP digest is bumped, by 2026-11-07.
   # https://security.alpinelinux.org/vuln/CVE-2026-85091
   - vulnerability: CVE-2026-85091
     package:
diff --git a/ui/.nvmrc b/ui/.nvmrc
index 8dfc5cb1af..ce62013c39 100644
--- a/ui/.nvmrc
+++ b/ui/.nvmrc
@@ -1 +1 @@
-24.18.1
+24.22.1
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 22149a9fa9..35e1f162a4 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -1,5 +1,5 @@
 # Keep in sync with ui/.nvmrc.
-FROM node:24.18.1-alpine@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3 AS base
+FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS base
 
 LABEL maintainer="https://github.com/prowler-cloud"
 
@@ -7,25 +7,9 @@ LABEL maintainer="https://github.com/prowler-cloud"
 # the bundled-npm CVE surface from every stage, incl. prod.
 # No blanket apk upgrade: it resolves against Alpine's live repo, so the digest pin
 # above would not make the image reproducible. Move the digest forward instead, or
-# take a named package as the targeted exception below.
+# take a named package as a targeted, commented exception.
 RUN corepack enable && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
-# High CVEs fixed in Alpine 3.24 but not yet in the pinned base image:
-#   libcrypto3/libssl3 3.5.8-r0  CVE-2026-14456, CVE-2026-14457, CVE-2026-18798,
-#                                CVE-2026-54874, CVE-2026-63072, CVE-2026-63075,
-#                                CVE-2026-63076  (image ships 3.5.7-r0)
-# The base image pins node 24.18.1, which has not been rebuilt since that package
-# was published, so the upgrade is taken here rather than by moving the pin -- the
-# newest published node:24-alpine (24.19.0, built 2026-08-03) predates the
-# 2026-08-13 advisory and carries the same vulnerable version. libcrypto3 and
-# libssl3 are both built from openssl and are flagged separately, so both are named.
-# `>=` rather than `=`: Alpine keeps only the newest build of a package in a
-# branch's index, so an exact pin breaks this build the day 3.5.8-r0 is superseded.
-# Drop this once the base image ships 3.5.8-r0 or later.
-RUN apk add --no-cache --upgrade \
-    "libcrypto3>=3.5.8-r0" \
-    "libssl3>=3.5.8-r0"
-
 # Install dependencies only when needed
 FROM base AS deps
 # Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
diff --git a/ui/changelog.d/node-24.22.1-bump.security.md b/ui/changelog.d/node-24.22.1-bump.security.md
new file mode 100644
index 0000000000..702345872a
--- /dev/null
+++ b/ui/changelog.d/node-24.22.1-bump.security.md
@@ -0,0 +1 @@
+Node.js from 24.18.1 to 24.22.1 LTS in the UI container image and `.nvmrc`, patching the eight CVEs of the October 2026 security release that affect the 24.x line, including the Brotli decoder remote code execution (CVE-2026-111497); the base image moves to Alpine 3.24, so the targeted `libcrypto3` / `libssl3` upgrade is no longer needed