October 29
Node API runtime v1.2.296
Importante
New Relic scans the Node API runtime image for vulnerabilities every day and publishes a patched release every Thursday. Each release includes fixes for operating system and application CVEs identified by Tuesday 6:29 PM UTC of that week. If we identify a CVE after that time, the fix ships in the following week's Thursday release.
We publish every release to the latest tag, which runs Node.js 22. Private locations that use latest get fixes automatically. If you use a specific version tag, manually update to the newest version to get current fixes.
Security patches
Library vulnerabilities:
- Upgraded undici to 7.30.1 (6.29.1 inside npm): CVE-2026-109383, CVE-2026-109829, CVE-2026-109841, CVE-2026-109869, CVE-2026-109924, CVE-2026-109932, CVE-2026-87018, CVE-2026-87029
- Upgraded ip-address to 10.7.4: CVE-2026-111997
- Upgraded nodemailer to 10.2.1: GHSA-85x2-q946-cp5h, GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-4ffr-jq9g-5ffx, GHSA-g73g-hqqh-jr95
- Upgraded qs to 6.16.1: CVE-2026-110816
OS vulnerabilities:
- Updated zlib1g to 1:1.3.dfsg-3.1ubuntu2.3: CVE-2026-85091
- Updated libbrotli1: CVE-2026-111497
CA certificates:
- Addressed the eMudhra certificate authority compromise by removing trust for the eMudhra (emSign) root certificates and the Comodo AAA Certificate Services root from the OS CA bundle and the respective keystores
October 22
Node API runtime v1.2.294
Improvements
- Upgraded node version 22.20.0 to 22.23.4 (fixes critical node CVEs)
Security patches
Fixed the following vulnerabilities:
OS vulnerabilities:
- CVE-2026-16517
- CVE-2026-46675
- CVE-2026-76781
- CVE-2026-86138
- CVE-2026-86142
- CVE-2026-86143
- CVE-2026-86144
- CVE-2026-88806
- CVE-2026-94283
- CVE-2026-94284
- CVE-2026-94285
- CVE-2026-96512
Library vulnerabilities:
- CVE-2026-111755
- CVE-2026-111756
- CVE-2026-111497
- CVE-2026-106069
- CVE-2026-105483
- CVE-2026-105482
- CVE-2026-105481
- CVE-2026-106072
- CVE-2026-106074
- CVE-2026-106070
- CVE-2026-106071
- CVE-2026-106073
October 8
Node API runtime v1.2.289
Security patches
OS vulnerabilities:
- CVE-2026-94287
- CVE-2026-95512
Library vulnerabilities:
- CVE-2026-104844
October 1
Node API runtime v1.2.286
Patches de segurança
Vulnerabilidades do sistema operacional:
- CVE-2026-13608
- CVE-2026-18924
- CVE-2026-56131
- CVE-2026-56132
- CVE-2026-56406
- CVE-2026-56407
- CVE-2026-56409
- CVE-2026-56410
- CVE-2026-56411
- CVE-2026-66046
- CVE-2026-72522
- CVE-2026-76641
- CVE-2026-76957
- CVE-2026-80230
- CVE-2026-82209
September 24
Node API runtime v1.2.284
Security patches
OS vulnerabilities:
- CVE-2025-59375
- CVE-2026-32776
- CVE-2026-32777
- CVE-2026-32778
- CVE-2026-41080
- CVE-2026-45186
- CVE-2026-50219
- CVE-2026-56403
- CVE-2026-56404
- CVE-2026-56405
- CVE-2026-56408
- CVE-2026-56412
- CVE-2026-74860
- CVE-2026-82474
- CVE-2026-86140
Library vulnerabilities:
- CVE-2026-17495
- CVE-2026-18149
- CVE-2026-18540
- CVE-2026-19534
- CVE-2026-84890
- CVE-2026-84933
- CVE-2026-84947
- CVE-2026-84961
- CVE-2026-85008
- CVE-2026-85014
- CVE-2026-85024
- CVE-2026-90771
- CVE-2026-90776
September 17
Node API runtime v1.2.278
Security patches
OS vulnerabilities:
- CVE-2026-56208
- CVE-2026-56209
- CVE-2026-56210
- CVE-2026-56211
September 10
Node API runtime v1.2.272
Security patches
Fixed the following vulnerabilities:
OS vulnerabilities:
- CVE-2026-46275
- CVE-2026-53357
- CVE-2026-64015
- CVE-2026-64018
- CVE-2026-64032
- CVE-2026-64073
- CVE-2026-64115
- CVE-2025-71289
- CVE-2026-23469
- CVE-2026-31420
- CVE-2026-31486
- CVE-2026-31560
- CVE-2026-46158
- CVE-2026-46170
- CVE-2026-46315
- CVE-2026-52912
- CVE-2026-52915
- CVE-2026-52916
- CVE-2026-52918
- CVE-2026-52919
- CVE-2026-52921
- CVE-2026-52922
- CVE-2026-52926
- CVE-2026-52941
- CVE-2026-64025
- CVE-2026-64029
- CVE-2026-64033
- CVE-2026-64039
- CVE-2026-64046
- CVE-2026-64047
- CVE-2026-64048
- CVE-2026-64051
- CVE-2026-64055
- CVE-2026-64056
- CVE-2026-64064
- CVE-2026-64083
- CVE-2026-64084
- CVE-2026-64085
- CVE-2026-64086
- CVE-2026-64087
- CVE-2026-64088
- CVE-2026-64089
- CVE-2026-64092
- CVE-2026-64096
- CVE-2026-64097
- CVE-2026-64098
- CVE-2026-64102
- CVE-2026-64106
- CVE-2026-64108
- CVE-2026-64109
- CVE-2026-64111
- CVE-2026-64113
- CVE-2026-64114
- CVE-2026-64116
- CVE-2026-64118
- CVE-2026-64121
- CVE-2026-64125
- CVE-2026-64126
- CVE-2026-64127
- CVE-2026-64128
- CVE-2026-64133
- CVE-2026-64134
- CVE-2026-64135
- CVE-2026-64136
- CVE-2026-64137
- CVE-2026-64138
- CVE-2026-64144
- CVE-2026-64147
- CVE-2026-64148
- CVE-2026-64155
- CVE-2026-64163
- CVE-2026-64165
- CVE-2026-64166
- CVE-2026-64168
- CVE-2026-64170
- CVE-2026-64173
- CVE-2026-64174
- CVE-2026-64177
- CVE-2026-64178
- CVE-2026-64179
- CVE-2026-64180
- CVE-2026-64182
- CVE-2026-64183
- CVE-2026-64184
- CVE-2026-64185
- CVE-2026-64214
- CVE-2026-64217
- CVE-2026-64218
- CVE-2026-64219
- CVE-2026-64220
- CVE-2026-64221
- CVE-2026-64225
- CVE-2026-64231
- CVE-2026-64518
- CVE-2026-57062
- CVE-2026-64034
- CVE-2026-64103
- CVE-2026-64153
Library vulnerabilities:
- CVE-2026-84367
- CVE-2026-84368
- CVE-2026-84375
- GHSA-2x7j-588g-ccc2
- GHSA-8m3c-c648-2xjj
- GHSA-cc9r-2j5m-2m83
- GHSA-wmmp-3585-3rmp
- GHSA-x5fp-wj9c-mxmx
- GHSA-4mjr-xmp4-gh2g
- CVE-2026-82417
- CVE-2026-82562
September 3
Node API runtime v1.2.267
Fixes
- Scripted API monitors: Updated script execution to run in an isolated context, preventing scripts from traversing the JavaScript prototype chain to access sandbox-restricted objects and functions.
Security patches
Fixed the following vulnerabilities:
OS vulnerabilities:
- CVE-2024-2236
- CVE-2025-5278
- CVE-2025-6141
- CVE-2025-15649
- CVE-2026-7017
- CVE-2026-9538
- CVE-2026-12087
- CVE-2026-13221
- CVE-2026-13595
- CVE-2026-13757
- CVE-2026-18938
- CVE-2026-27171
- CVE-2026-27456
- CVE-2026-42250
- CVE-2026-48959
- CVE-2026-48962
- CVE-2026-53612
- CVE-2026-53613
- CVE-2026-53614
- CVE-2026-53615
- CVE-2026-53910
- CVE-2026-54371
- CVE-2026-57432
- CVE-2026-57433
- CVE-2026-59843
- CVE-2026-59845
- CVE-2026-59846
- CVE-2026-59847
- CVE-2026-59848
- CVE-2026-59850
Library vulnerabilities:
- CVE-2026-55553
August 27
Node API runtime v1.2.262
Security patches
Fixed the following vulnerabilities:
OS vulnerabilities:
- CVE-2026-53224
- CVE-2026-64531
- CVE-2026-11856
- CVE-2026-53246
- CVE-2026-62289
- CVE-2026-53247
- CVE-2026-8932
Library vulnerabilities:
- CVE-2026-55553