MENU
On 21 October 2026 the Node.js project released security fixes for every supported line, and the 24.x line we run in production had four flaws rated high. Our production platform was running the patched runtime by about 17:10 UTC the same day, roughly two and a half hours after the patched official container images were published. This note is about how we treat a release like that: as the day's priority, not as a backlog item.
The 21 October security releases shipped Node.js 24.22.1, 22.23.4 and 26.12.1. On the 24.x line they fix eight vulnerabilities, four rated high, including an out-of-bounds write in the Brotli decoder that can allow remote code execution and two ways to bypass TLS certificate hostname checks. Our services decompress HTTP responses and open TLS connections to the services agents pay, so these were not theoretical for us.
We opened a tracking issue at 12:43 UTC that day and treated it as the day's work. By 14:56 UTC our build and test pipelines on GitHub Actions ran on Node.js 24.22.1. The patched official Node.js images appeared on Docker Hub at 14:45 UTC; the docker-node project explains why images follow a release by a few hours. We cut a release on top of them, rolled it to staging, and exercised the card payment flows there against Stripe in test mode before touching production. By about 17:10 UTC every production service of the platform (the API, the MCP server, the web app and the AI Services Catalog) was on the patched runtime and healthy.
A runtime fix only counts once it is everywhere the runtime runs. We audited every repository and every deployed service, not only the core platform: demos, tutorials, internal agents and build tooling. By the next morning every service we build and deploy ran a patched Node.js release. One demo agent had been retired from its source repository weeks earlier and could not be rebuilt, so we took it down rather than leave it on an unsupported runtime. Two things are not in our hands yet, and we are tracking both: a serverless runtime managed by our hosting provider, still on an unpatched release when we checked on 21 October, and one third-party tool on our staging environment that has no patched release.
Agents pay through Nevermined, so the software in that path has to be current, not merely working. A security release is a deadline we did not choose, and the useful measure is hours, not sprints.
See what agents can pay for through Nevermined in the AI Services Catalog.
See Nevermined
in Action
Real-time payments, flexible pricing, and outcome-based monetization—all in one platform.
