Node.js: check the runtime actually running your application
CERT-FR reports vulnerabilities in three Node.js branches. Updating project dependencies does not by itself replace the runtime.
Going deeper
Generated image · SecuFocus
At a glance
Key points
If you maintain an application running on Node.js, check the runtime used by its service, container or host. CERT-FR reports multiple vulnerabilities and gives fixed-version boundaries for branches 22, 24 and 26. An npm package update does not prove that runtime has changed.
The three branches named by CERT-FR
Advisory CERTFR-2026-AVI-1367, published on 22 October, lists Node.js 22.x before 22.23.4, 24.x before 24.22.1, and 26.x before 26.12.1. It directs readers to the publisher’s fixes. These boundaries concern the named branches; they do not establish that an older branch is still maintained.
CERT-FR lists risks including remote code execution and security-policy bypass. The advisory read here does not detail each flaw’s conditions or report active exploitation. We do not conclude that every Node.js application is exploitable in the same way.
| Node.js branch | Listed fixed-version boundary |
|---|---|
| 22.x | 22.23.4 |
| 24.x | 24.22.1 |
| 26.x | 26.12.1 |
The relevant number belongs to the service
The Node.js in your terminal can differ from the one used by a background service or a container image. Identify the environment actually running the application. If software bundles its own runtime, follow that publisher’s update rather than replacing part of the bundle manually.
For managed hosting, send the advisory to your provider and ask which runtime serves the application. If you manage the environment, prepare a rollback and check application compatibility before changing major branches. The task is to apply the fix, not improvise a migration.
Read the version again after updating
After applying the update appropriate to your installation and restarting the service as required, read the version again in that same environment. Check that the application starts and its important functions work. A download or rebuilt image alone does not prove the running service uses the new runtime.
This is SecuFocus’s maintenance recommendation based on the advisory. We have neither tested the listed versions nor reproduced the vulnerabilities.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.