From c2c33473c3e5c2e8e399bc5bf8b485ae8d6d04be Mon Sep 17 00:00:00 2001
From: Ivan Shumkov <ivanshumkov@gmail.com>
Date: Thu, 4 Jun 2026 14:49:48 +0700
Subject: [PATCH] fix(dashmate): bump Envoy gateway to 1.35.11 for HTTP/2 DoS
 (CVE-2026-47774)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Platform Gateway runs dashpay/envoy:1.30.2-impr.1 (Envoy 1.30.x),
affected by GHSA-22m2-hvr2-xqc8 / CVE-2026-47774 (CVSS 7.5): an
unauthenticated HTTP/2 downstream memory-exhaustion DoS — cookie header
bytes bypass max_request_headers_kb and HPACK decode amplification
expands small encoded headers into large decoded ones. The 1.30 line is
EOL; 1.35.11 is the patched line published upstream.

- Bump the base config default gateway image to dashpay/envoy:1.35.11-impr.1
  (built + published from dashpay/docker-envoy#3; multi-arch, verified to
  contain Envoy 1.35.11).
- Add a 3.0.2 config migration that rewrites only the EOL 1.30.x Envoy image
  to the patched default, leaving deliberately customised images untouched.
  No migration above 3.0.0 touched the gateway image, so v3 configs
  (3.0.0..3.0.1-hotfix.*) would otherwise stay on the vulnerable image.
- Update gateway/update docs.

Config validated against Envoy 1.35.11 (envoy --mode validate, all
conditional branches): loads clean, zero deprecation warnings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../configs/defaults/getBaseConfigFactory.js   |  2 +-
 .../configs/getConfigFileMigrationsFactory.js  | 18 ++++++++++++++++++
 packages/dashmate/docs/config/gateway.md       |  2 +-
 packages/dashmate/docs/update.md               |  2 +-
 4 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/packages/dashmate/configs/defaults/getBaseConfigFactory.js b/packages/dashmate/configs/defaults/getBaseConfigFactory.js
index 3ea84fb7509..632da308838 100644
--- a/packages/dashmate/configs/defaults/getBaseConfigFactory.js
+++ b/packages/dashmate/configs/defaults/getBaseConfigFactory.js
@@ -172,7 +172,7 @@ export default function getBaseConfigFactory() {
         },
         gateway: {
           docker: {
-            image: 'dashpay/envoy:1.30.2-impr.1',
+            image: 'dashpay/envoy:1.35.11-impr.1',
           },
           maxConnections: 1000,
           maxHeapSizeInBytes: 125000000, // 1 Gb
diff --git a/packages/dashmate/configs/getConfigFileMigrationsFactory.js b/packages/dashmate/configs/getConfigFileMigrationsFactory.js
index c1b3bb77726..509ed437b35 100644
--- a/packages/dashmate/configs/getConfigFileMigrationsFactory.js
+++ b/packages/dashmate/configs/getConfigFileMigrationsFactory.js
@@ -1398,6 +1398,24 @@ export default function getConfigFileMigrationsFactory(homeDir, defaultConfigs)
 
         return configFile;
       },
+      '3.0.2': (configFile) => {
+        // Patch the Platform Gateway (Envoy) image for CVE-2026-47774 /
+        // GHSA-22m2-hvr2-xqc8: an unauthenticated HTTP/2 downstream
+        // memory-exhaustion DoS. Only configs still on the EOL,
+        // dashmate-shipped 1.30.x Envoy image are bumped to the patched base
+        // default (Envoy 1.35.11); a deliberately customised image (private
+        // fork, vendor-patched build, `:latest`, etc.) is left untouched.
+        const patchedImage = base.get('platform.gateway.docker.image');
+        Object.entries(configFile.configs)
+          .forEach(([, options]) => {
+            const docker = options.platform?.gateway?.docker;
+            if (docker && /^dashpay\/envoy:1\.30\./.test(docker.image)) {
+              docker.image = patchedImage;
+            }
+          });
+
+        return configFile;
+      },
     };
   }
 
diff --git a/packages/dashmate/docs/config/gateway.md b/packages/dashmate/docs/config/gateway.md
index 43cc47bb63b..d398062bd0d 100644
--- a/packages/dashmate/docs/config/gateway.md
+++ b/packages/dashmate/docs/config/gateway.md
@@ -6,7 +6,7 @@ The `platform.gateway` section configures the Dash Platform Gateway, which serve
 
 | Option | Description | Default | Example |
 |--------|-------------|---------|---------|
-| `platform.gateway.docker.image` | Docker image for Gateway | `dashpay/envoy:1.30.2-impr.1` | `dashpay/envoy:latest` |
+| `platform.gateway.docker.image` | Docker image for Gateway | `dashpay/envoy:1.35.11-impr.1` | `dashpay/envoy:latest` |
 
 ## Listeners
 
diff --git a/packages/dashmate/docs/update.md b/packages/dashmate/docs/update.md
index f00bc76af82..2a3566d0417 100644
--- a/packages/dashmate/docs/update.md
+++ b/packages/dashmate/docs/update.md
@@ -78,7 +78,7 @@ $  dashmate update --format=json --config local_1 | jq
     "name": "gateway",
     "title": "Gateway",
     "updated": "up to date",
-    "image": "dashpay/envoy:1.30.2-impr.1"
+    "image": "dashpay/envoy:1.35.11-impr.1"
   }
 ]
 ```