René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"deps: bundled OpenSSL 3.5.5 in v24.x has multiple CVEs, fixed in OpenSSL 3.5.6","articleBody":"### Version\n\nv24.15.0\n\n### Platform\n\n```text\nLinux, x86_64. Image: `node:24-alpine`, digest `sha256:d1b3b4da11eefd59...`, last pushed 2026-04-16, alpine 3.23 base.\n```\n\n### Subsystem\n\ndeps / openssl\n\n### What steps will reproduce the bug?\n\n1. `docker pull node:24-alpine`\n2. `docker run --rm node:24-alpine node -p \"process.versions.openssl\"`\n   returns `3.5.5`.\n3. The OpenSSL 3.5.6 release notes\n   (\u003chttps://github.com/openssl/openssl/releases/tag/openssl-3.5.6\u003e) list\n   the seven CVEs fixed in that release; v24.x ships 3.5.5 and is\n   therefore exposed:\n\n   | CVE | Severity | CVSS |\n   | --- | --- | --- |\n   | [CVE-2026-31789](https://nvd.nist.gov/vuln/detail/CVE-2026-31789) | Critical | 9.8 |\n   | [CVE-2026-28387](https://nvd.nist.gov/vuln/detail/CVE-2026-28387) | High | 8.1 |\n   | [CVE-2026-28388](https://nvd.nist.gov/vuln/detail/CVE-2026-28388) | High | 7.5 |\n   | [CVE-2026-28389](https://nvd.nist.gov/vuln/detail/CVE-2026-28389) | High | 7.5 |\n   | [CVE-2026-28390](https://nvd.nist.gov/vuln/detail/CVE-2026-28390) | High | 7.5 |\n   | [CVE-2026-31790](https://nvd.nist.gov/vuln/detail/CVE-2026-31790) | High | 7.5 |\n   | [CVE-2026-2673](https://nvd.nist.gov/vuln/detail/CVE-2026-2673)   | High | 7.5 |\n\n4. Optional, end-to-end repro via Amazon Inspector using the public\n   [`aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1`](https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector)\n   action with `artifact_type: container` and `artifact_path: node:24-alpine`\n   reproduces all seven findings against `pkg:generic/openssl/openssl@3.5.5`\n   with `Fixed Package: 3.5.6` and paths under\n   `/usr/local/include/node/openssl/...`.\n\n\n### How often does it reproduce? Is there a required condition?\n\nReproducible against any v24.15.0 image.\n\n### What is the expected behavior? Why is that the expected behavior?\n\nA v24.x patch release that bumps `deps/openssl` from 3.5.5 to 3.5.6,\nclearing the seven CVEs.\n\n[OpenSSL 3.5.6](https://github.com/openssl/openssl/releases/tag/openssl-3.5.6)\nwas published 2026-04-07 with fixes for the CVEs above. Node v24.15.0\nwas published 2026-04-15, eight days after the OpenSSL release, but\nships OpenSSL 3.5.5 — pinned at `deps/openssl/openssl/VERSION.dat`:\n\n\u003chttps://github.com/nodejs/node/blob/848430679556aed0bd073f2bc263331ad84fa119/deps/openssl/openssl/VERSION.dat#L1-L3\u003e\n\nAs of 2026-05-04, no newer 24.x release has shipped, leaving downstream\nCVE-gating CI blocked on the bundled OpenSSL.\n\n### What do you see instead?\n\n`node -p \"process.versions.openssl\"` returns `3.5.5` in the `node:24-alpine` container.\n\n[inspector_scan_25270031181.pdf](https://github.com/user-attachments/files/27372715/inspector_scan_25270031181.pdf)\n\n### Additional information\n\n`gh pr list --repo nodejs/node --state open --search \"openssl in:title\"`\non 2026-05-04 shows no open `deps: upgrade openssl to 3.5.6` PR. If a\nv24.x release with OpenSSL 3.5.6 is already on the security release\nschedule, a pointer to the tracking issue would help.","author":{"url":"https://github.com/roger-pmta","@type":"Person","name":"roger-pmta"},"datePublished":"2026-05-04T18:53:52.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/63122/node/issues/63122"}