23 lines
916 B
JavaScript
23 lines
916 B
JavaScript
// CVE-2026-111497: Node's bundled Brotli decoder must include the security fix.
|
|
// Check Node versions: patched releases can still report Brotli 1.2.0.
|
|
// https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
|
|
'use strict';
|
|
|
|
function requireSafeNode() {
|
|
const [major, minor, patch] = process.versions.node.split('.').map(Number);
|
|
const minimum = { 22: [23, 4], 24: [22, 1], 26: [12, 1] }[major];
|
|
const patched = minimum && (minor > minimum[0] ||
|
|
(minor === minimum[0] && patch >= minimum[1]));
|
|
|
|
if (!patched) {
|
|
throw new Error(
|
|
`CVE-2026-111497: Node.js ${process.versions.node} is not an approved patched runtime. ` +
|
|
'Use Node.js 22.23.4+, 24.22.1+ or 26.12.1+ within those release lines. ' +
|
|
'Recommended: nvm install && nvm use (see .nvmrc). Restart all server/PM2 processes after upgrading.'
|
|
);
|
|
}
|
|
}
|
|
|
|
requireSafeNode();
|
|
module.exports = requireSafeNode;
|