Vulnerability Identifier: NR26-11
Priority: High
Summary
We are issuing this bulletin to inform you of critical security vulnerabilities in Node.js versions (22.x, 24.x, 26.x) that may require customer action for New Relic Synthetic monitoring customers using Public and Private locations.
Fixed versions: The fixed Node.js versions are 22.23.4, 24.22.1, and 26.12.1.
End-of-life (EOL) versions: Node.js 20 and older, including Node.js 16.x, are end-of-life and will not receive patches from the Node.js project. The only remediation for EOL versions of Node.js is migration to a supported release.
Action required
These vulnerabilities impact Synthetic monitoring customers using both Public and Private locations. Customer action for each is as follows.
Public locations
Customer action depends on whether your monitors are on the latest runtime.
No action required: No action is required for monitors deployed in Public locations that are on the latest supported runtime.
Runtime | Action taken |
|---|---|
Node API runtime (including |
|
Node browser runtime | All browser monitors have been upgraded to the latest patched Node version. |
Action required: Customers whose monitors are not on the latest runtime need to update them, in accordance with New Relic's earlier communication. If your scripted API monitor is on an older Node.js runtime, you must update it as soon as possible. For instructions, see Upgrade scripted API monitors to Node.js 22.
Runtime | Action required |
|---|---|
Node API runtime (including | Enabled scripted API monitors on Node 16 are not auto-upgraded to Node 22.23.4, because the upgrade may break customer-owned monitors. We advise you to upgrade your scripted API monitors from Node 16 to Node 22.23.4 before November 18, 2026. After that date, the older API runtimes will no longer be supported. |
Private locations
Action required: For Private locations, you must pull the latest runtime images to remediate these CVEs. Action is required for monitors deployed in Private locations if you don't use the latest tag.
The New Relic Synthetics job manager (SJM) itself is not the source of the vulnerability. However, the node-api-runtime and node-browser-runtime container images bundle Node.js and are directly affected.
If you're running Private locations, take the following steps:
Pull the latest versions of the affected runtime images:
bash$# Node API runtime$docker pull newrelic/synthetics-node-api-runtime:latest$$# Node browser runtime$docker pull newrelic/synthetics-node-browser-runtime:latestRestart your containers after pulling the updated images to apply the fix.
For more information, see the runtime transition guide.
Important notice: Node.js 16.x scripted API monitors
If you have scripted API monitors configured to run on Node.js 16.x, be aware that:
- Node.js 16.x will not receive a security patch for these CVEs from the Node.js project, because it has already reached end-of-life.
- New Relic has not automatically force-upgraded Node.js 16.x monitors to Node 22.x, because script compatibility can't be guaranteed. Some monitor scripts may require code changes to run correctly on Node 22.x.
We strongly recommend that you review and migrate your Node 16.x monitors to Node 22.23.4 as soon as possible, and not wait until November 18, 2026. For detailed migration instructions, see Upgrade scripted API monitors to Node.js 22.
Technical vulnerability information
Ten CVEs were disclosed across Node.js versions (22.x, 24.x, 26.x), four of which are rated High severity.
High severity CVEs:
- CVE-2026-111497
- CVE-2026-106069
- CVE-2026-105483
- CVE-2026-105482
Other CVEs:
- CVE-2026-105481
- CVE-2026-106072
- CVE-2026-106074
- CVE-2026-106070
- CVE-2026-106071
- CVE-2026-106073
Frequently asked questions
Do I need to update the Synthetics job manager (SJM)?
No. These vulnerabilities are in the Node.js runtime bundled within the runtime container images, not in SJM itself. Only the runtime container images require updating.
Will updating the runtime images affect my running monitors?
Monitors continue to run normally after the runtime image update. There is no behavioral change for monitors running on Node 22.x.
Can CVE-2026-111497 be exploited remotely?
Yes. This is a remote code execution vulnerability. It can be triggered when a Node.js process receives a Brotli-compressed HTTP response from a server an attacker controls. No local access is required.
I'm running Node 16.x monitors. Am I at risk?
Yes. Node 16.x is end-of-life and won't be patched. Your monitors remain vulnerable until you migrate them to Node 22.23.4. You can do this yourself using the runtime upgrade tool. For more information, see Manage monitor runtimes.
Why wasn't my Node 16.x monitor automatically upgraded?
Node 22.x includes breaking changes from Node 16.x, which New Relic communicated earlier. Scripted API monitors still on Node 16.x are those that couldn't be automatically upgraded without failing. New Relic therefore made this a customer-initiated upgrade to avoid unintended monitor breakage. We'll follow the EOL timelines communicated earlier and will force-upgrade Node 16.x monitors on November 18, 2026.
Do I need to reboot or restart anything after updating Private location runtimes?
Only a container restart is required. No host reboot is needed.
Who can I contact if I still have questions?
Open a case with our Support team through the help section in the New Relic platform.
Publication history
October 21, 2026 - Node.js CVEs disclosed
October 27, 2026 - NR26-11 Published