From 78bd5bd3cff95615c72f3be54b9f3dd40ca2e1c6 Mon Sep 17 00:00:00 2001
From: Adam Shannon <adamkshannon@gmail.com>
Date: Wed, 21 Oct 2026 14:42:54 -0500
Subject: [PATCH] security: pin Node.js 24.22.1-slim

Pick up the 2026-10-21 Node.js security release (Brotli RCE CVE-2026-111497, TLS hostname bypasses). node:slim is a moving tag and can lag the patched LTS line.
---
 Dockerfile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index b32c8f1..2c71750 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,7 @@
-FROM node:slim
+# Node 24.22.1 includes the 2026-10-21 security release
+# (CVE-2026-111497 Brotli RCE, TLS hostname bypasses).
+# https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
+FROM node:24.22.1-slim
 
 ENV NODE_ENV=production