[P0] Build separate Node.js advisory checker repositories #4

Completed delivery — 2026-10-26 UTC

The merged Node matrix maps all 21 named July/October CVEs to Node2Shell plus 20 separate advisory checkers, preserving each snapshot's verified boundaries, exclusions and prerequisites. Older snapshot revisions and historical exact-head CI receipts are explicitly distinguished.

PR #22 adds optional builtin capability metadata and bounded npm engines.node build context; OCI PR #1 adds independent container/SBOM metadata and actual conservative consumer profiles. Both are merged and their actual merge-commit CI passed. Node2Shell's 65 core/metadata tests preserve the original CLI/collector regression behavior. Tests guard against app imports, environment/argument access, network and active API use. Available APIs and declared engine ranges do not establish runtime use, reachability or installed Node identity; application-use evidence remains unknown. Standalone offline checkers keep embedded snapshots and not_tested exploitability.

Exact delivery receipts. The historical reconciliation and planning text below is superseded by this completion record.

Delivery reconciliation — 2026-10-25

Twenty additional advisory-specific Node repositories are implemented and merged, separate from Node2Shell. Each audited default-branch SHA has successful hosted CI. This is substantially beyond the historical initial delivery below.

Still open: produce the complete July/October advisory-to-repository matrix, reconcile exact coverage/exclusions, and complete the original lockfile/container and runtime-feature metadata requirements where justified. Most existing Node tools accept explicit versions and operator observations; these are not independently collected runtime capability evidence. No combined Node posture scanner or mandatory shared runtime is introduced.

Full dated audit and exact commit/CI receipts · merged reconciliation PR #20

User clarification — one repository per exploit (2026-10-23)

Each distinct exploit/advisory must ship in its own standalone repository. This issue is a planning/coordination grouping; it must not become a scanner aggregating unrelated vulnerabilities. Common parsing, evidence contracts and output code may be bundled into each checker without requiring a shared runtime. See parent issue #2 for the current repository mapping.

Retain node2shell-check for CVE-2026-111497. Each additional Node vulnerability needs its own exploit-specific repository; do not build a combined node-security-posture scanner.

Priority: P0 | Proposed artifact: node-security-posture
Estimate from report: MVP 10–15 person-days; hardened 20–30 person-days (rough estimates, not commitments).
Parent: Security checker family roadmap

Outcome

Generalize Node2Shell's evidence model to a multi-advisory Node.js posture engine while retaining the existing portable reference checker.

Scope

• Create an advisory-by-advisory matrix for verified July/October 2026 Node releases, using runtime inventory, explicit versions, lockfiles and container metadata.
• Collect only determinable runtime/build feature metadata for HTTP/2, Permission Model, TLS, DNS, snapshot/SEA and Brotli; source context is separate from runtime capability.
• Define compatibility/migration with node2shell-check before changing its public CLI or schema; retain an independently usable offline path.

Acceptance criteria

• Existing Node2Shell classification/collector regression fixtures continue to pass.
• Each advisory has independently sourced version boundaries and applicable precondition fixtures.
• Collector has no app imports, environment/argument dumps, network, shell execution or decoding; absent evidence is unknown.
• Apply the parent roadmap's shared release gates: primary-source verification, uncertainty handling, bounded parsing, deterministic outputs, meaningful synthetic tests, privacy and documentation.
• Keep the core independently usable offline with an embedded rule snapshot; default to Python 3.10+ standard library and document any justified exception.
• Preserve local exploitability: not_tested; record actual observations separately from inference and external exploitation reports.

Dependencies and sequencing

Bundle the evidence contract and template material tracked by #13 directly into each exploit's repository. Every scanner must run independently, including when its distributed Python entry point is copied alone; no separate shared-rules repository or hosted feed is required.

This is a planning issue in the reference repository. The proposed artifact name identifies the intended destination; creating this issue does not create that repository or require implementing an unrelated scanner inside node2shell-check.

Verification plan

Use synthetic version boundaries, absent/present/ambiguous preconditions, conflicting and vendor-qualified evidence, malformed/bounded inputs and output escaping/privacy cases. No production-target scanning in CI. Verify applicable Linux/Windows/macOS behavior, CLI help and documented examples before release.

Sources to verify

Origin: user-supplied Research Report: High-Value Security Checkers to Build After Node2Shell, dated 2026-10-23. Advisory statements and thresholds above are research leads, not independently verified facts. Check the primary sources and record exact validated claims/dates before enabling any detection rule; omit unsupported claims.

• https://nodejs.org/en/blog/vulnerability/july-2026-security-releases
• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• https://github.com/CompleteTech-LLC/node2shell-check