[heygengenesis]

What

Moves every hyperframes image runtime that bundles Google's Brotli decoder to a release with the CVE-2026-111497 fix:

Image	Runtime that decodes	Before	After
packages/gcp-cloud-run/Dockerfile	Bun (CMD ["bun", "dist/server.js"])	Bun 1.4.2 on node:22.23.3	Bun 1.4.4 on node:22.23.4
packages/cli/src/docker/Dockerfile.render (hyperframes render --docker)	Node (hf-render)	node:22.23.3-bookworm-slim	node:22.23.4-bookworm-slim
Dockerfile.test (producer regression image)	Node and Bun	node:22.23.3, Bun 1.3.13	node:22.23.4, Bun 1.4.4 (matches engines.bun in package.json)

Why

CVE-2026-111497 ("Node2Shell") is an out-of-bounds write in Google's Brotli decoder, rated CVSS 9.2, with a public RCE proof of concept. Node and Bun both bundle a copy of the decoder, and both auto-decode Content-Encoding: br in fetch(). The fixed versions are Node 22.23.4 and Bun 1.4.4; 22.23.3 and 1.4.2 are the releases just before them.

The render path is reachable: the producer's htmlCompiler fetch()es remote asset src URLs from compositions. On Cloud Run that code runs under Bun, so the Bun bump is what closes the hole there. The Node bump alone would not, and the first revision of this PR missed that. Neither runtime has a switch to turn off br decoding in fetch(), so upgrading is the fix.

AWS Lambda needs no change. The handler zip runs on the managed nodejs22.x runtime, which AWS patches. The arm64 video function is a container on public.ecr.aws/lambda/nodejs:22@sha256:d138eff4…. That digest is the current 22 tag, built 2026-10-22, and its /var/lang/bin/node is v22.23.4, which I checked from the image layer itself.

Related work

Refs https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497

How

Version pins only. No comments are added.

Test plan

• Unit tests added/updated: not applicable (runtime pins only)
• Manual testing performed:
  • With Bun 1.4.4: bun install --frozen-lockfile passes (741 packages). The Cloud Run build chain from the Dockerfile (parsers → … → gcp-cloud-run build) passes. bun dist/server.js boots and logs server_listening, which exercises the ESM require interop the pin comment warns about.
  • The node:22.23.4-bookworm-slim tag is published, and Bun 1.4.4's linux x64 and aarch64 release assets resolve.
  • CI's BeginFrame contract job and the Docker regression job build these images.
• Documentation updated (if applicable): not applicable
• Comments follow CONTRIBUTING.md "Comments"

Genesis session: https://genesis.hg.dev/v2/sessions/b313b8f6-cff5-5be0-a85e-da9e2b63c286
Session owner: Joel Gallardo

🤖 Generated with Claude Code

[joel-hg]

Reviewed head c18b1d9 against main 3e16603. No blocking findings.

Security coverage: all three affected Dockerfiles select Node 22.23.4, and both Bun installations select 1.4.4. Cloud Run's actual entrypoint is Bun, so its Bun update is necessary and present. Node's release explicitly fixes CVE-2026-111497. Bun 1.4.4 pins google/brotli commit db24a98aed38a16de78cc05ca15cdd8dc2a0d92d (1.2.1), whose upstream release explicitly fixes the CVE. These releases are over three days old. No dependency constraints, locks, application code, or unrelated pins changed.

Independent validation in an isolated checkout, using checksum-verified Bun 1.4.4 and Node 22.23.4:

• bun install --frozen-lockfile: passed, 741 packages; bun.lock unchanged.
• bun run build: passed for the full workspace, including Cloud Run and CLI.
• bun run --cwd packages/gcp-cloud-run test: 104 passed, 0 failed.
• Focused runtime smoke: Brotli roundtrip and malformed-input rejection; actual compiler inlineExternalScripts fetched and decoded a Brotli HTTP response; built Cloud Run server started under Bun, /healthz returned 200, and malformed JSON returned 400.

CI on this head passed build/typecheck/lint/tests, the GCP BeginFrame image contract, and all ten Docker render regression shards. Logs confirm Node 22.23.4 and Bun 1.4.4 in the rebuilt images. The GCP CI job targets only beginframe-contract; the local full build/startup smoke supplies the missing application-stage evidence. The cancelled Studio/player capture job is immaterial to these runtime-only changes.

The existing Lambda base digest d138eff445f6ea04c51091d8e6cbb064d5663e850cddfa62396061586f98b126 resolves to an arm64 image created 2026-10-22; its Node version header and embedded binary version identify 22.23.4. Native execution was unavailable on this x64 host, so this is artifact inspection, not an arm64 execution test.

Operational limits: this approval covers source/image construction, not deployed-runtime attestation. Rebuild/redeploy Cloud Run and distribute the updated CLI release; existing version-tagged CLI renderer images are cached and need replacement if testing within the same CLI version. Managed Lambda runtime rollout was not inspected. During the first representative render batch after rollout, watch Cloud Run startup, handler_error, asset-fetch/decompression failures, and render latency. Use the actual service/revision names; the Terraform default service is hyperframes-render. Example Cloud Logging filter: resource.type="cloud_run_revision" resource.labels.service_name="hyperframes-render" (jsonPayload.event="handler_error" OR severity>=ERROR). No Datadog service mapping was established.

Sources: https://nodejs.org/en/blog/release/v22.23.4 ; https://github.com/oven-sh/bun/blob/bun-v1.4.4/scripts/build/deps/brotli.ts ; https://github.com/google/brotli/releases/tag/v1.2.1 .