Ride-The-Lightning/RTL v0.15.15

Release v0.15.15-beta

on GitHub

0.15.15 is a Node.js security release. Node.js published its October 2026 security releases on 2026-10-21, and two of the fixes reach RTL as deployed. RTL's own code is unchanged from 0.15.14; the release moves the Docker image and the supported Node range onto the fixed runtime, and brings in two dependency updates. Operators running the Docker image should pull v0.15.15; bare-metal installs should upgrade Node to 22.23.4 or 24.22.1 (or later).

Full detail in release-notes/Release-notes-0.15.15.md.

Node.js 22.23.4

• CVE-2026-111497 (High): an out-of-bounds write in Node's bundled Brotli decoder. RTL's request-body parser and its HTTP client both accept Brotli-encoded content, so the decoder runs on data from the network. The fix is in the runtime, not in RTL.
• eMudhra intermediate-CA compromise: Node now carries a blocklist of the leaked intermediate keys and drops the emSign roots. In RTL this matters only for the fiat-rate and fee-estimate calls; connections to the Lightning nodes use the node's own certificate.
• The Docker image is built on node:22-alpine, so v0.15.15 ships on Node 22.23.4 (v0.15.14 was built on 22.23.3). For bare-metal installs engines.node is now >=22.23.4 <23 || >=24.22.1, the README and CONTRIBUTING say the same, and CI no longer tests on Node 20, which is end of life and does not receive the fix (#1780).

Dependencies

• follow-redirects 1.16.1, used by axios: fixes GHSA-q3jh-wrc6-jgq8 and GHSA-8r9p-f939-6h3c, where credential headers could survive a cross-origin redirect. npm audit --omit=dev is back at 0. (#1780, supersedes #1778)
• Angular 20.3.34, all framework packages together (#1780, supersedes #1779). Angular 22 (#1732) is a migration and stays open.

PGP Key: https://keybase.io/suheb
Retrieve the source code repository, check for the latest release and verify the code signature

$ git clone https://github.com/Ride-The-Lightning/RTL.git
$ cd RTL

$ git checkout v0.15.15

$ git verify-tag v0.15.15
gpg: Signature made Wed Oct 21 12:54:38 2026 PDT
gpg:                using RSA key 3E9BD4436C288039CA827A9200C9E2BC2E45666F
gpg: Good signature from "saubyk (added uid) <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "Suheb <39208279+saubyk@users.noreply.github.com>" [ultimate]
gpg:                 aka "RTL Security <security@ridethelightning.info>" [ultimate]

Install RTL via npm ci

npm ci --omit=dev --legacy-peer-deps

Docker images available at https://hub.docker.com/r/shahanafarooqui/rtl/tags