Skip to content

Security audit: Verify all runtime versions address January 2026 CVEs#2819

Draft
Copilot wants to merge 3 commits intomainfrom
copilot/fix-cves-in-oryx
Draft

Security audit: Verify all runtime versions address January 2026 CVEs#2819
Copilot wants to merge 3 commits intomainfrom
copilot/fix-cves-in-oryx

Conversation

Copy link
Contributor

Copilot AI commented Feb 5, 2026

All runtime versions in Oryx are current with January 2026 security patches. No remediation required.

Verified Versions

Node.js - Addresses 8 CVEs (CVE-2025-55131, CVE-2025-55130, CVE-2025-59465, others)

  • 18.20.8, 20.20.0, 22.22.0, 24.13.0

PHP - Addresses 7+ CVEs (CVE-2025-14178, CVE-2025-14180, CVE-2025-1735, others)

  • 8.1.34, 8.2.30, 8.3.29, 8.4.16 (SHA256 verified)

Python - Latest releases, no critical CVEs

  • 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.11, 3.14.2

.NET - Latest maintenance releases

  • 8.0.23, 9.0.12, 10.0.2

Changes

  • Added SECURITY_AUDIT_2026-02-05.md documenting CVE coverage, version verification, and SHA256 hashes

Notes

  • Node.js fixes include High severity: Buffer leaks (CVE-2025-55131), symlink attacks (CVE-2025-55130), HTTP/2 DoS (CVE-2025-59465)
  • PHP fixes include heap overflow, null pointer dereference, SQL injection, command injection
  • All versions cross-referenced against official security advisories (nodejs.org, php.net, CISA, NVD)
  • No Oryx-specific CVEs identified

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Copilot AI and others added 2 commits February 5, 2026 13:05
Co-authored-by: surenderssm <12485087+surenderssm@users.noreply.github.com>
Co-authored-by: surenderssm <12485087+surenderssm@users.noreply.github.com>
Copilot AI changed the title [WIP] Fix all CVEs in Oryx Security audit: Verify all runtime versions address January 2026 CVEs Feb 5, 2026
Copilot AI requested a review from surenderssm February 5, 2026 13:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants