From 47a5add2c42c9315fff33d724aefb8122a0a9650 Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Wed, 28 Oct 2026 16:59:36 +0100 Subject: [PATCH] doc: document OpenJS CNA reservation and publication steps When `cve_source` is set to `openjs-cna` in `.ncurc`, `git node security --request-cve` reserves CVE ids through the OpenJS Foundation CNA instead of HackerOne. Publication to MITRE is then handled by the `Publish CVEs` workflow in the nodejs-private/security-release repository, which runs when the security release pull request is merged and holds until every patched version is on nodejs.org/dist. Update the security release runbook accordingly: * Note the OpenJS CNA option under 'Requesting CVEs', including the resume behaviour on supervised buckets. * Mark 'Request publication of H1 CVE requests' in cleanup as a no-op under the OpenJS CNA path. * Add a Post-Release step describing the automatic publication, the nodejs.org gate, the failure issue and the delay before cve.org. * Scope the HackerOne form under 'Updating CVEs' to HackerOne-issued ids and point OpenJS-issued ids at the CNA coordinators. Refs: https://github.com/openjs-foundation/security-wg/issues/337 Refs: https://github.com/nodejs/node-core-utils/pull/1232 Refs: https://github.com/nodejs-private/security-release/pull/87 Assisted-by: Claude Signed-off-by: Ulises Gascon --- doc/contributing/security-release-process.md | 33 ++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md index 7444707774f..e0c4ffab560 100644 --- a/doc/contributing/security-release-process.md +++ b/doc/contributing/security-release-process.md @@ -79,6 +79,13 @@ The current security stewards are documented in the main Node.js * Make sure to have a green CI before requesting a CVE. * Check if there is a need to issue a CVE for any version that became EOL after the last security release through [this issue](https://github.com/nodejs/security-wg/issues/1419). + * If `cve_source: openjs-cna` is set in `.ncurc`, the CVE ids are reserved + through the [OpenJS Foundation CNA][] instead of HackerOne. The HackerOne + report is updated with the id either way. On a supervised bucket the + reservation waits for a CNA coordinator; the command saves the pending + request in `vulnerabilities.json` and can be re-run to resume it. + Publication to MITRE then happens from the [security-release][] + repository, see [Post-Release](#post-release). * [ ] 5\. **Choosing or Updating Release Date:** * Get agreement on the planned date for the release. @@ -177,7 +184,8 @@ security announcements for more information. * Close HackerOne reports: * Close Resolved * Request Disclosure - * Request publication of H1 CVE requests + * Request publication of H1 CVE requests _(skip when the CVEs were + reserved through the OpenJS Foundation CNA, see the next step)_ * In case the reporter doesn't accept the disclosure follow this process: Remove the original report reference within the reference text box and insert the public URL you would like to be attached to this CVE. @@ -188,6 +196,22 @@ security announcements for more information. vulnerability DB. * [ ] Add yourself as a steward in the [Security Release Stewards](https://github.com/nodejs/node/blob/HEAD/doc/contributing/security-release-process.md#security-release-stewards) +* [ ] 2\. **Publish CVEs to MITRE (OpenJS Foundation CNA path only):** + * Skip this step if `cve_source` is `hackerone` (the default): HackerOne + publishes to MITRE automatically during disclosure. + * Merging the security release pull request in the [security-release][] + repository triggers its `Publish CVEs` workflow. It publishes every + reserved CVE listed in `vulnerabilities.json` through the OpenJS + Foundation CNA. Nothing has to be run by hand. + * The workflow refuses to publish until every patched version is available + on , so do not expect records before the + release is out, and do not merge the pull request earlier than usual. + * [ ] Check the workflow run summary. A failed run opens an issue in the + `security-release` repository assigned to the CNA coordinator and to the + person who merged, with the per-CVE details to forward to the OpenJS CNA. + * Records appear on about 15 minutes after a + successful run. + ## Adding a security revert option Breaking changes are allowed in existing LTS lines in order to fix @@ -248,7 +272,7 @@ then we later change the `fixed in` value for the CVE. ### Updating CVEs -The steps to correct CVE information are: +For CVEs issued by HackerOne, the steps to correct CVE information are: * Go to the “CVE IDs” section in your program sections () @@ -257,4 +281,9 @@ The steps to correct CVE information are: * Include all the details that need updating within the form * Submit the request +For CVEs issued by the OpenJS Foundation CNA, fix `vulnerabilities.json` in +the [security-release][] repository and ask the OpenJS CNA coordinators to +update the record. Automatic updates are planned, see the repository README. + +[OpenJS Foundation CNA]: https://github.com/openjs-foundation/security-advisories [security-release]: https://github.com/nodejs-private/security-release