5.3.3 release notes

Released 2026-11-02

Highlights

5.3.3 is a patch release that upgrades Node.js to address vulnerabilities from the Node.js October 2026 security release.

Node.js 22.23.4

The cht-api and cht-sentinel images run Node.js 22.23.4, up from 22.23.2 (#11515). This version fixes the following vulnerabilities:

• CVE-2026-111497 (High): An out-of-bounds write in the Brotli decoder that could allow remote code execution. API and Sentinel can reach this code through responses to outbound requests, for example outbound push, RapidPro, and Africa’s Talking.
• CVE-2026-106069 (High): A bypass of TLS hostname verification on outbound HTTPS requests.

The release also removes trust in the compromised eMudhra intermediate certificate authority (emSign ECC Root CA - G3) from both the Node.js certificate store and the cht-nginx image’s ca-certificates bundle.

Known issues

Check the repository for the latest known issues.

Upgrade notes

All instances running 5.3.x should upgrade to 5.3.3.

If you are running CHT 5.3.0 or 5.3.1, read the 5.3.2 upgrade notes before upgrading.

Breaking changes

None.

UI/UX changes

None.

And more…

Features

None.

Improvements

None.

Security fixes

• #11515: Update Node to 22.23.4 for October 2026 security release

Performance improvements

None.

Bug fixes

None.

Technical improvements

None.

Contributors

Thanks to all who committed changes for this release!

• Tom Wier