Hey,
Node.js published a security release on October 21 for Node 22, 24 and 26 official advisory. It fixes four high-severity issues, including:
- a Brotli decoder out-of-bounds write that can lead to remote code execution when your server decompresses
brcontent, for examplefetchresponses from an external API; - TLS certificate hostname-verification bypasses;
- a
dns.resolveissue with names containing a NUL character.
The fixed versions are 22.23.4, 24.22.1 and 26.12.1.
Why this matters for Meteor apps
Meteor ships its own Node.js. Your app runs the Node version bundled with your Meteor release, not the latest Node. For example, Meteor 3.5.3 bundles Node 24.15.0, which is affected.
At the time of writing, Meteor has not published a release with the patched Node yet. We are watching for it and will let you know when it is out.
What we did
Our Meteor runtime images (zcloudws/meteor-node-mongodb-runtime and zcloudws/meteor-node-runtime) copy Node.js from Meteor itself, so production runs exactly what Meteor was tested with. We are not changing that.
For cases like this, we created a parallel hotfix image. It is the same runtime image you already use, with only the node binary replaced by the official Node.js build. We verify the build's signature against the Node.js release keys and check its SHA256. npm, MongoDB tools and everything else stay the same. The Node major version doesn't change, so your native npm modules keep working.
We already run Quave ONE itself on this hotfix image in production.
The hotfix tags put the Node version after your Meteor version:
zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools
How to patch your app now
If your app already has a Dockerfile, change the FROM line of the runtime stage:
# before
FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-with-tools
# after
FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools
Then deploy as usual.
If Quave ONE generates the Dockerfile for you (you never added one), add this Dockerfile to the root of your Meteor project. It matches the one we generate, with only the runtime image changed:
FROM zcloudws/meteor-build:3.5.3 AS builder
WORKDIR /app-source/source
USER root
RUN chown zcloud:zcloud -R /app-source
USER zcloud
COPY --chown=zcloud:zcloud . /app-source/source
ENV METEOR_DISABLE_OPTIMISTIC_CACHING=1
RUN meteor npm --no-audit install && meteor build --directory ../app-build
FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools
COPY --from=builder /app-source/app-build/bundle /home/zcloud/app
RUN cd /home/zcloud/app/programs/server && chmod +rw npm-shrinkwrap.json && npm --no-audit install
WORKDIR /home/zcloud/app
ENV NODE_EXTRA_CA_CERTS=/quave-one-tls/ca.crt
ENTRYPOINT ["/scripts/startup.sh"]
If some of your environment variables are sent to the build, add one ARG NAME line for each of them after the first FROM.
Using a different Meteor version? Just reply to this email with your version and we will publish a hotfix tag for it.
When Meteor releases the fix
Once Meteor publishes a release with the patched Node, update your app's Meteor version as usual. The regular tags already include the fix at that point, so you can go back to them and remove the -node… part (or your custom Dockerfile, if you added it only for this). We will email you when that happens.
If anything looks off after deploying, reply here and we will help.
Filipe