重要
New Relic scans the Node browser runtime image for vulnerabilities every day and publishes a patched release every Thursday. Each release includes fixes for operating system, application, and Chrome CVEs identified by Tuesday 6:29 PM UTC of that week. If we identify a CVE after that time, the fix ships in the following week's Thursday release.
We publish every release to the latest tag, which runs Node.js 22 and the latest stable version of Chrome. Private locations that use latest get fixes automatically. If you use a specific version tag, manually update to the newest version to get current fixes.
Improvements and enhancements
- Upgraded Chrome from 154.0.8037.57-1 to 156.0.8078.47-1
Security patches
Library vulnerabilities:
- Upgraded undici to 7.30.1 (6.29.1 inside npm): CVE-2026-109383, CVE-2026-109829, CVE-2026-109841, CVE-2026-109869, CVE-2026-109924, CVE-2026-109932, CVE-2026-87018, CVE-2026-87029
- Upgraded ip-address to 10.7.5 (10.7.4 inside npm): CVE-2026-111997
- Upgraded nodemailer to 10.2.1: GHSA-85x2-q946-cp5h, GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-4ffr-jq9g-5ffx, GHSA-g73g-hqqh-jr95
- Upgraded qs to 6.16.1: CVE-2026-110816
OS vulnerabilities:
- Updated zlib1g to 1:1.3.dfsg-3.1ubuntu2.3: CVE-2026-85091
- Updated libbrotli1: CVE-2026-111497
CA certificates:
- Addressed the eMudhra certificate authority compromise by removing trust for the eMudhra (emSign) root certificates and the Comodo AAA Certificate Services root from the OS CA bundle and the respective keystores