Update Node.js to address security vulnerabilities

[chansuke]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

https://nodejs.org/en/blog/vulnerability/december-2025-security-releases
Multiple high-severity security vulnerabilities have been disclosed in Node.js.
We currently use affected versions that need to be updated.

Affected versions in this repository

• Node.js 22.9.0
  • used in ui/.nvmrc, CI workflow, test container
  • Action: Update to 22.22.0 or later
• Node.js 23.0.0
  • used in production Dockerfile and ui-test
  • Action: migration to LTS version or update to latest 23.x
• Node.js 20
  • used in Dockerfile.ui.tilt without specific version
  • Action: Pin to 20.20.0 or later

Key vulnerabilities

• CVE-2025-55131 (High): Memory leak exposing sensitive data in vm module
• CVE-2025-55130 (High): Permission Model bypass via symlinks
• CVE-2025-59465 (High): HTTP/2 server DoS
• CVE-2025-59464 (Medium): TLS memory leak
• CVE-2026-21636 (Medium): Unix domain socket bypass of network restrictions
• CVE-2026-21637 (Medium): Process termination via TLS PSK/ALPN callbacks
• CVE-2025-55132 (Low): futimes() permission issue

Files requiring update

• ui/.nvmrc
• .github/workflows/ci-build.yaml
• Dockerfile (argocd-ui stage)
• Dockerfile.ui.tilt
• ui-test/Dockerfile
• test/container/Dockerfile

Renovate Status

There is an existing Renovate PR (#24615), but it has issues

• The PR is blocked due to manual edits (see Dependency Dashboard Dependency Dashboard #24608)
• The proposed version (22.19.0) does not meet the security requirement (22.22.0+)
• Node.js 22.22.0 and 20.20.0 were released on January 13, 2026 (after the PR was created)
• test/container/Dockerfile is not managed by Renovate and requires manual update

To Reproduce

Expected behavior

Screenshots

Version

Paste the output from `argocd version` here.

Logs

Paste any relevant application logs here.

[nitishfy]

@chansuke want to take this up?

[chansuke]

@nitishfy
yes!