[NEXT-SECURITY-RELEASE] Heads up on upcoming Node.js security release 2026/07/29

[RafaelGSS]

As per security release workflow, creating issue to give the docker team a heads up.

[MikeMcC399]

Delayed (at least) by one day

[RafaelGSS]

Security release is out

[MikeMcC399]

@RafaelGSS

Thanks for the heads-up! Good to hear you managed to get through the infrastructure issues! 🚀

[MikeMcC399]

Noted in https://openjs-foundation.slack.com/archives/C019MGJQ8RH/p1785335435863249 that Node.js 24.18.1 is not yet promoted.

Juan José is working on fixing it.

[nschonni]

docker-library/official-images#21944 should be building out the v22 images. Still waiting for the 24/26 ones to build out on the https://unofficial-builds.nodejs.org/logs/status.html

[nroose]

Just lurking here - and noticed that the docker images that just hit the repository are still showing the vulnerabilities.

[nschonni]

Just lurking here - and noticed that the docker images that just hit the repository are still showing the vulnerabilities.

https://github.com/docker-library/faq/#why-does-my-security-scanner-show-that-an-image-has-cves

[nschonni]

Created a manual PR for 26 #2582, but I think the bot should open one with 26+24 in an hour or so

[MikeMcC399]

Created a manual PR for 26 #2582, but I think the bot should open one with 26+24 in an hour or so

I've landed your PR for 26.5.1

Automation is still going wrong for the remaining 24.18.1, which https://nodejs.org/download/release/index.json correctly labels as a security release:

  {
    "version": "v24.18.1",
    "date": "2026-07-28",
    "files": [
      "aix-ppc64",
      "headers",
      "linux-arm64",
      "linux-ppc64le",
      "linux-s390x",
      "linux-x64",
      "osx-arm64-tar",
      "osx-x64-pkg",
      "osx-x64-tar",
      "src",
      "win-arm64-7z",
      "win-arm64-zip",
      "win-x64-7z",
      "win-x64-exe",
      "win-x64-msi",
      "win-x64-zip"
    ],
    "npm": "11.16.0",
    "v8": "13.6.233.17",
    "uv": "1.52.1",
    "zlib": "1.3.1",
    "openssl": "3.5.7",
    "modules": "137",
    "lts": "Krypton",
    "security": true
  },

https://github.com/nodejs/docker-node/actions/runs/30521223827/job/90801847376

Run actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
22.23.2

24.18.0

26.5.1

There's no musl build for version 24.18.1 yet.

22.23.1 & 26.5.1 from the security release are already up to date and dealt with, there is only 24.18.1 still to do, and that should not be waiting for a musl build.

https://unofficial-builds.nodejs.org/ has yet to start processing 24.18.1. It is still busy with other builds for 26.5.1.

Given that any PRs submissions to https://github.com/docker-library/official-images generally don't get merged until the PDT USA time zone working day (UTC-7), there would be no advantage in manually putting together a PR for 24.18.1 Debian without Alpine right now. That would however be a back-stop solution if there is no musl build for 24.18.1 produced in the next 8 hours, in other words by 15:00 UTC.

[MikeMcC399]

https://unofficial-builds.nodejs.org/ started processing 24.18.1 at 30-Jul-2026 10:03 UTC.

[MikeMcC399]

#2584 has completed a full set of variants (Debian and Alpine) for Node.js 24.18.1.

All actions for the July 2026 security release necessary in this repo have now been completed.

Leaving this issue open until docker-library/official-images#21951 has landed.

Work to fix the automation so it correctly handles security releases in future is however still outstanding.

[MikeMcC399]

Publication status

All Dockerfiles have been passed to https://github.com/docker-library/official-images for image building and publication.

See Release availability for a description of how built images appear on Docker Hub with delay.

Ticked below when fully published on Docker Hub:

• Node.js 22.23.2
• Node.js 24.18.1
• Node.js 26.5.1