Node.js Oct 21 Security Release, Next.js, Docker Recap

Executive Summary

• Node.js security releases land tomorrow (Wed, Oct 21) for the 22.x, 24.x and 26.x lines, with a highest severity of HIGH in all three. The project has not yet published CVE IDs or counts; see the official announcement.
• Next.js 16.4.1 / 15.5.28 remain the must-have patches for two critical unauthenticated RCEs and one high-severity DoS. Details in the Vercel advisory.
• Docker Engine 29.9.1 is still the latest Engine release in the release notes and bundles containerd 2.4.2 security fixes.
• Vercel changelog (Oct 17-19): AI Gateway logs now show session affinity, new models on AI Gateway, and updated Hobby and Pro Terms of Service. See the Vercel changelog.

Node.js: Prepare for the October 21 Security Releases

The pre-announcement, published Oct 14, says each of Node.js 26.x, 24.x and 22.x gets a security release, and that the most severe issue fixed is HIGH in every line. End-of-life lines are always affected by security releases, so anything off the release schedule should move to a supported version. Current lines are 24.22.0 (LTS) and 26.12.0 (Current). Until the advisory has CVE details, prepare rather than guess at impact:

1. Inventory which Node versions your services and base images actually run.
2. Reserve a patch window on Oct 21 and rebuild images once patched tags are published.

node --version
# in containers
docker run --rm node:24 node --version

Next.js: Patch Status Check

The Oct 14 out-of-band release fixes GHSA-673q-mjm6-r5xr (critical RCE via use cache functions returning typed arrays, no workaround), CVE-2026-96889 (critical RCE in SVG Image Optimization on glibc Linux) and GHSA-p3m5-59mp-jv5r (high DoS with Server Actions). Verify what you actually deploy, including the transitive sharp version, which must be 0.35.5 or later:

npm ls next sharp
npm install [email protected]   # or [email protected] on the 15.x line

Docker Engine 29.9.1: containerd 2.4.2

The 29.9.1 release (Oct 14) updates containerd to 2.4.2: CVE-2026-95839 (malformed digest crashes containerd on pull or import), GHSA-8647-2jxj-p2rc (crafted Content-Length from an untrusted registry crashes containerd with parallel layer fetching) and GHSA-hc94-p972-ch66 (layer data not capped at declared size, enabling disk exhaustion). Hosts that pull from third-party registries should prioritize it.

docker version --format '{{.Server.Version}}'   # expect 29.9.1

Vercel: AI Gateway and Terms Updates

On Oct 18 Vercel added session affinity to AI Gateway logs, and on Oct 19 it published updates to the Hobby and Pro Terms of Service. If you run on those plans, read the terms change.

Coverage note: GitHub release feeds were not reachable in this run, and no verified new releases were found for the other tracked stacks (identity, databases, ORMs, queues), so they are omitted rather than guessed.