Repository navigation
deps: bundled OpenSSL 3.5.5 in v24.x has multiple CVEs, fixed in OpenSSL 3.5.6 #63122
Description
Version
v24.15.0
Platform
Linux, x86_64. Image: `node:24-alpine`, digest `sha256:d1b3b4da11eefd59...`, last pushed 2026-04-16, alpine 3.23 base.
Subsystem
deps / openssl
What steps will reproduce the bug?
-
docker pull node:24-alpine -
docker run --rm node:24-alpine node -p "process.versions.openssl"
returns3.5.5. -
The OpenSSL 3.5.6 release notes
(https://github.com/openssl/openssl/releases/tag/openssl-3.5.6) list
the seven CVEs fixed in that release; v24.x ships 3.5.5 and is
therefore exposed:CVE Severity CVSS CVE-2026-31789 Critical 9.8 CVE-2026-28387 High 8.1 CVE-2026-28388 High 7.5 CVE-2026-28389 High 7.5 CVE-2026-28390 High 7.5 CVE-2026-31790 High 7.5 CVE-2026-2673 High 7.5 -
Optional, end-to-end repro via Amazon Inspector using the public
aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
action withartifact_type: containerandartifact_path: node:24-alpine
reproduces all seven findings againstpkg:generic/openssl/openssl@3.5.5
withFixed Package: 3.5.6and paths under
/usr/local/include/node/openssl/....
How often does it reproduce? Is there a required condition?
Reproducible against any v24.15.0 image.
What is the expected behavior? Why is that the expected behavior?
A v24.x patch release that bumps deps/openssl from 3.5.5 to 3.5.6,
clearing the seven CVEs.
OpenSSL 3.5.6
was published 2026-04-07 with fixes for the CVEs above. Node v24.15.0
was published 2026-04-15, eight days after the OpenSSL release, but
ships OpenSSL 3.5.5 — pinned at deps/openssl/openssl/VERSION.dat:
node/deps/openssl/openssl/VERSION.dat
Lines 1 to 3 in 8484306
As of 2026-05-04, no newer 24.x release has shipped, leaving downstream
CVE-gating CI blocked on the bundled OpenSSL.
What do you see instead?
node -p "process.versions.openssl" returns 3.5.5 in the node:24-alpine container.
inspector_scan_25270031181.pdf
Additional information
gh pr list --repo nodejs/node --state open --search "openssl in:title"
on 2026-05-04 shows no open deps: upgrade openssl to 3.5.6 PR. If a
v24.x release with OpenSSL 3.5.6 is already on the security release
schedule, a pointer to the tracking issue would help.
Activity
MikeMcC399 commentedon May 5, 2026
The PR that merged OpenSSL 3.5.6 into the
mainbranch is already closed (search with--state all) and it was #62629.If you want to track its release into the Node.js 24 Active LTS branch, you can subscribe through the Watch button -> Custom -> Releases in the https://github.com/nodejs/node UI.
I imagine that first Node.js 26.0.0 will need to be released, then a 26.x version after that, and then after a minimum 2 weeks in the current release line (see Criteria for backporting) it would be released in a 24.x version and so end up in a
node:24-alpineDocker image.Releasers may be able to give you a more accurate estimate and picture of how this may unfold.
I also noted that OpenSSL 3.5.6 has a different categorization of the severities and they say that they've corrected most severe Moderate. For example https://openssl-library.org/news/vulnerabilities/#CVE-2026-31790 is classed as "Moderate", which differs from https://nvd.nist.gov/vuln/detail/CVE-2026-31789 where it's listed as 9.8 CRITICAL.
roger-pmta commentedon May 5, 2026
Thanks @MikeMcC399! Appreciate the link 🙇♂️
fix(typescript): switch base to trixie-slim to clear OS-package CVEs
chore(typescript): patch container vulns in typescript-sdk-cli + vali…