October's Node.js fixes have to land in Azure Pipelines more than once

Ten Node.js vulnerabilities fixed on October 21 have to be patched in Azure Pipelines more than once, because Node.js sits in several layers of a pipeline and each layer updates on its own. That is the core of security guidance Microsoft published on November 5 on the Azure DevOps Blog. The fixed releases are Node.js 22.23.4, 24.22.1 and 26.12.1.

The bugs most relevant to build infrastructure sit in name and certificate handling. CVE-2026-105482 can truncate a DNS name containing a NUL character after a full-name security check has already passed. CVE-2026-105483, CVE-2026-106069 and CVE-2026-106072 let unusual IP address spellings get past certificate identity checks. CVE-2026-111497 is a Brotli decompression bug that can corrupt memory when attacker-controlled data reaches an affected decoder. Per the guidance, the same Brotli CVE is also fixed in .NET, with patched baselines of 8.0.33, 9.0.22 and 10.0.14.

Each copy has its own owner

The agent comes first. Self-hosted agent v5.281.1, released October 23, moves its bundled Node24 runner to 24.22.1, and Microsoft says to roll it out through the supported agent-pool update process. Azure DevOps Server installations should follow the agent support for their release instead of installing this agent everywhere.

Next is the Node.js a pipeline picks for itself. Both UseNode@1 and NodeTool@0 default checkLatest to false. Microsoft's advice is to select a fixed release, or a later supported patch in the same major line, and keep that selection current.

Task and extension publishers need to update handlers and dependencies and publish new versions. Consumers should move to compatible, supported versions without forcing incompatible tasks onto Node24. Job containers and deployed applications are serviced separately again: update the runtime or image inputs, rebuild, redeploy, then verify the running version.

Check the binary, not the label

For Microsoft-hosted agents, the guidance warns against assuming patch status from an image label. Verify the job image, the agent and the executable that actually ran. Microsoft names two commands for it:

- script: |
    node --version
    node -p "process.execPath"
  displayName: Report the Node.js this step resolved

The version line answers whether the step got a fixed release. The path line answers which installed copy it came from, which is what tells you whether the agent, a tool task or the image supplied it.

Updating the agent pool closes one path. Containers and applications already deployed keep running the Node.js they were built with until someone rebuilds them.