Hey,

Node.js published a security release on October 21 for Node 22, 24 and 26 official advisory. It fixes four high-severity issues, including:

• a Brotli decoder out-of-bounds write that can lead to remote code execution when your server decompresses br content, for example fetch responses from an external API;
• TLS certificate hostname-verification bypasses;
• a dns.resolve issue with names containing a NUL character.

The fixed versions are 22.23.4, 24.22.1 and 26.12.1.

Why this matters for Meteor apps

Meteor ships its own Node.js. Your app runs the Node version bundled with your Meteor release, not the latest Node. For example, Meteor 3.5.3 bundles Node 24.15.0, which is affected.

At the time of writing, Meteor has not published a release with the patched Node yet. We are watching for it and will let you know when it is out.

What we did

Our Meteor runtime images (zcloudws/meteor-node-mongodb-runtime and zcloudws/meteor-node-runtime) copy Node.js from Meteor itself, so production runs exactly what Meteor was tested with. We are not changing that.

For cases like this, we created a parallel hotfix image. It is the same runtime image you already use, with only the node binary replaced by the official Node.js build. We verify the build's signature against the Node.js release keys and check its SHA256. npm, MongoDB tools and everything else stay the same. The Node major version doesn't change, so your native npm modules keep working.

We already run Quave ONE itself on this hotfix image in production.

The hotfix tags put the Node version after your Meteor version:

zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools

How to patch your app now

If your app already has a Dockerfile, change the FROM line of the runtime stage:

# before
FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-with-tools
# after
FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools

Then deploy as usual.

If Quave ONE generates the Dockerfile for you (you never added one), add this Dockerfile to the root of your Meteor project. It matches the one we generate, with only the runtime image changed:

FROM zcloudws/meteor-build:3.5.3 AS builder

WORKDIR /app-source/source
USER root
RUN chown zcloud:zcloud -R /app-source

USER zcloud
COPY --chown=zcloud:zcloud . /app-source/source

ENV METEOR_DISABLE_OPTIMISTIC_CACHING=1

RUN meteor npm --no-audit install && meteor build --directory ../app-build

FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools
COPY --from=builder /app-source/app-build/bundle /home/zcloud/app

RUN cd /home/zcloud/app/programs/server && chmod +rw npm-shrinkwrap.json && npm --no-audit install

WORKDIR /home/zcloud/app

ENV NODE_EXTRA_CA_CERTS=/quave-one-tls/ca.crt

ENTRYPOINT ["/scripts/startup.sh"]

If some of your environment variables are sent to the build, add one ARG NAME line for each of them after the first FROM.

Using a different Meteor version? Just reply to this email with your version and we will publish a hotfix tag for it.

When Meteor releases the fix

Once Meteor publishes a release with the patched Node, update your app's Meteor version as usual. The regular tags already include the fix at that point, so you can go back to them and remove the -node… part (or your custom Dockerfile, if you added it only for this). We will email you when that happens.

If anything looks off after deploying, reply here and we will help.

Filipe