[marktran]

Summary

Node.js's October 21, 2026 security release fixes a high-severity RCE (CVE-2026-111497, Brotli decoder out-of-bounds write) and TLS hostname-verification bypasses. This repo pins Node 24.12.0, so it's still vulnerable. This PR moves the pin to the patched release on the same major line: 24.12.0 -> 24.22.1. Part of an org-wide sweep requested by @marktran (workos/workos is handled separately).

Changed:

• .mise.toml

Verification:

• Confirmed in https://nodejs.org/dist/index.json that the target version is published and marked as a security release.
• git grep shows no remaining non-historical references to the old version.
• CI on this PR runs on the new version.

Link to Devin session: https://app.devin.ai/sessions/2eebe08898634ccab61b0501a4d6a6f6
Open in Devin Desktop: https://app.devin.ai/desktop/session/2eebe08898634ccab61b0501a4d6a6f6?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

---

Original prompt from Devin Bot

Context: Node.js's October 21, 2026 security release (https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) fixes a high-severity RCE, CVE-2026-111497 (Brotli decoder out-of-bounds write), plus TLS hostname-verification bypasses. WorkOS security is treating it as an urgent production exposure. The fixed 24.x release is v24.22.1. Get the fixed versions for other release lines (22.x, 20.x, etc.) from the advisory; don't guess. Docker Hardened Images has now published dhi.io/node:24.22.1-debian13 and dhi.io/node:24.22.1-debian13-dev, and Docker Hub has node:24.22.1 / node:24.22.1-bookworm / node:24.22.1-alpine. The workos/workos monorepo is already handled in https://github.com/workos/workos/pull/77227. Use it as a reference, but do NOT touch workos/workos.

Requested by Mark Tran (GitHub marktran): "look at SDKs, Atlas, Passport, and any other repos with Nodes".

Task:

1. Inventory every repo in the workos GitHub org that runs or pins Node, using gh repo list workos --limit 1000 plus code search for .nvmrc, .node-version, .mise.toml, .tool-versions, Dockerfile* with node:/dhi.io/node, actions/setup-node node-version, engines.node, Vercel/Cloudflare/Lambda runtime settings. Include at least workos/atlas, workos/passport, and all SDKs (workos-node, authkit-js, authkit-nextjs, authkit-react, authkit-remix, etc.). Skip archived repos.
2. Classify each repo by exposure: (a) production runtime that serves traffic (Docker images, Lambdas, servers), which is highest priority, (b) CI/dev tooling only, (c) a published library/SDK where Node is only CI/dev. For SDKs, do NOT raise engines.node minimums or drop supported Node lines in CI matrices; that is a breaking change for customers. Only bump exact dev/CI pins (e.g. .nvmrc) to the patched release of the same line.
3. For every repo that pins a vulnerable Node version, open one PR per repo that moves it to the patched release on the same major line. Follow each repo's co... (754 chars truncated...)

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

@greptileai review

[greptile-apps]

Confidence Score: 5/5

[Low impact] This change appears safe to merge; no actionable issues were found.

Summary

Updates .mise.toml from Node 24.12.0 to 24.22.1.

• The repository now uses Node 24.22.1 for mise-based setup.

_{Reviews (1) · Last reviewed commit: "fix: move Node to 24.22.1 for the Octobe..." · Reviewed by Greptile}