deps: bundled OpenSSL 3.5.5 in v24.x has multiple CVEs, fixed in OpenSSL 3.5.6

[roger-pmta]

Version

v24.15.0

Platform

Linux, x86_64. Image: `node:24-alpine`, digest `sha256:d1b3b4da11eefd59...`, last pushed 2026-04-16, alpine 3.23 base.

Subsystem

deps / openssl

What steps will reproduce the bug?

1. docker pull node:24-alpine

2. docker run --rm node:24-alpine node -p "process.versions.openssl"
   returns 3.5.5.

3. The OpenSSL 3.5.6 release notes
   (https://github.com/openssl/openssl/releases/tag/openssl-3.5.6) list
   the seven CVEs fixed in that release; v24.x ships 3.5.5 and is
   therefore exposed:

   CVE	Severity	CVSS
   CVE-2026-31789	Critical	9.8
   CVE-2026-28387	High	8.1
   CVE-2026-28388	High	7.5
   CVE-2026-28389	High	7.5
   CVE-2026-28390	High	7.5
   CVE-2026-31790	High	7.5
   CVE-2026-2673	High	7.5

4. Optional, end-to-end repro via Amazon Inspector using the public
   aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
   action with artifact_type: container and artifact_path: node:24-alpine
   reproduces all seven findings against pkg:generic/openssl/openssl@3.5.5
   with Fixed Package: 3.5.6 and paths under
   /usr/local/include/node/openssl/....

How often does it reproduce? Is there a required condition?

Reproducible against any v24.15.0 image.

What is the expected behavior? Why is that the expected behavior?

A v24.x patch release that bumps deps/openssl from 3.5.5 to 3.5.6,
clearing the seven CVEs.

OpenSSL 3.5.6
was published 2026-04-07 with fixes for the CVEs above. Node v24.15.0
was published 2026-04-15, eight days after the OpenSSL release, but
ships OpenSSL 3.5.5 — pinned at deps/openssl/openssl/VERSION.dat:

node/deps/openssl/openssl/VERSION.dat

Lines 1 to 3 in 8484306

	MAJOR=3
	MINOR=5
	PATCH=5

As of 2026-05-04, no newer 24.x release has shipped, leaving downstream
CVE-gating CI blocked on the bundled OpenSSL.

What do you see instead?

node -p "process.versions.openssl" returns 3.5.5 in the node:24-alpine container.

inspector_scan_25270031181.pdf

Additional information

gh pr list --repo nodejs/node --state open --search "openssl in:title"
on 2026-05-04 shows no open deps: upgrade openssl to 3.5.6 PR. If a
v24.x release with OpenSSL 3.5.6 is already on the security release
schedule, a pointer to the tracking issue would help.

[MikeMcC399]

gh pr list --repo nodejs/node --state open --search "openssl in:title"
on 2026-05-04 shows no open deps: upgrade openssl to 3.5.6 PR. If a
v24.x release with OpenSSL 3.5.6 is already on the security release
schedule, a pointer to the tracking issue would help.

The PR that merged OpenSSL 3.5.6 into the main branch is already closed (search with --state all) and it was #62629.

If you want to track its release into the Node.js 24 Active LTS branch, you can subscribe through the Watch button -> Custom -> Releases in the https://github.com/nodejs/node UI.

I imagine that first Node.js 26.0.0 will need to be released, then a 26.x version after that, and then after a minimum 2 weeks in the current release line (see Criteria for backporting) it would be released in a 24.x version and so end up in a node:24-alpine Docker image.

Releasers may be able to give you a more accurate estimate and picture of how this may unfold.

I also noted that OpenSSL 3.5.6 has a different categorization of the severities and they say that they've corrected most severe Moderate. For example https://openssl-library.org/news/vulnerabilities/#CVE-2026-31790 is classed as "Moderate", which differs from https://nvd.nist.gov/vuln/detail/CVE-2026-31789 where it's listed as 9.8 CRITICAL.

[roger-pmta]

Thanks @MikeMcC399! Appreciate the link 🙇‍♂️