Repository navigation
Patch Node.js for the October 2026 security release #94
Description
The Backstage backend image runs on Node 24, which the October 2026 Node.js security release patches for ten vulnerabilities, including a Brotli decoder flaw that allows remote code execution and two ways to bypass TLS hostname checks. The same release drops the compromised eMudhra root from Node's built-in roots. Moving to Node 24.22.1 or later closes them.
Success looks like
- The image runs Node 24.22.1 or later and passes this repository's tests
- Production runs that release
- Renovate follows Node patch releases for this image
Related to datum-cloud/infra#7439
Activity
ecv commentedon Oct 22, 2026
Production runs v0.1.5 on Node 24.22.1, read from production metrics at 00:50 UTC on 22 October: the pod is ready, with no restarts in the last 30 minutes. It shipped in #95. The image pins the exact Node release, so Renovate lists each Node patch on its dashboard.