Hello, community!
Meteor 3.3.4, 3.4.3 and 3.5.4 are now available and recommended. These follow the previous security releases, with updated Node.js runtimes and additional fixes in Meteor itself.
As discussed in that thread, the backports needed some extra care around compatibility and validation across release lines. Thanks for your patience while we worked through those checks.
Highlights
Node.js security updates, included in your development workflow
These releases include the Node.js October 21 security updates. They address high-severity issues in DNS resolution, TLS certificate hostname validation and Brotli decompression, alongside other runtime and dependency fixes.
Meteor ships Node.js and npm as part of its development bundle. Updating your Meteor release brings the patched runtime into the Meteor CLI, your local application server and the build tools you use during development. The versions for each release line are listed below.
Galaxy images for all three releases are available. We verified example deployments on each release, including login and database persistence, plus an upgrade from 3.5.3 to 3.5.4 that preserved existing data.
If your production deployment manages Node.js separately, update that runtime as well. For Docker, update your base image or pinned Node.js version to match the patched runtime below, then rebuild and redeploy. Updating Meteor locally does not replace the Node.js installation in your Docker image or server.
Additional Meteor security fixes
- Accounts: strengthen single-use email-verification and passwordless tokens, and enforce configured two-factor authentication in custom passwordless login flows.
- Document handling: preserve document fields safely across EJSON, Minimongo and Meteor’s MongoDB integration.
- DDP: accept only explicitly registered methods and publications.
- MongoDB connections: strengthen startup connection security and keep credentials out of connection diagnostics.
- HTTP handling: harden proxy-header processing in
force-ssl, and update HTTP compression and OAuth body-parsing dependencies.
Meteor 3.5.4 also corrects client-address reporting with the optional uWebSockets DDP transport, which matters for IP-based rate limits and access checks. It also fixes stale Rspack HTML and chunk references when switching between development, production and test builds.
Update within your release line
Choose the patch matching your application’s current release line, or select a release when creating a new app. Each version below links to its full changelog and migration notes.
| Current line | Security patch and changelog | Update an existing app | Create a new app |
|---|---|---|---|
| 3.3.x | 3.3.4 | meteor update --release 3.3.4 |
meteor create my-app --release 3.3.4 |
| 3.4.x | 3.4.3 | meteor update --release 3.4.3 |
meteor create my-app --release 3.4.3 |
| 3.5.x | 3.5.4 | meteor update --release 3.5.4 |
meteor create my-app --release 3.5.4 |
Meteor 3.3.4 and 3.4.3 bundle Node.js 22.23.4 and npm 10.9.9. Meteor 3.5.4 bundles Node.js 24.22.1 and npm 11.19.1.
Update the Meteor release to receive the complete fixes. A package-only update on an older release leaves out the coordinated EJSON, Mongo and Minimongo changes. Review the migration notes, particularly if you use custom passwordless login flows with 2FA.
Thanks to @italojs and @Grubba27 for their work on these fixes, and to everyone helping with reports, reviews and testing. Please share your upgrade results and any regressions in this thread.
Our commitment to security, and how you can help
Security is ongoing work for Meteor. As shared in the release cadence discussion and our security backport update, we’re committed to improving both response times and the validation behind each release. We’re turning what we learn into automated checks and reusable release workflows, with a maintenance scope we can sustain reliably.
Reporting security issues
We welcome private security reports through Galaxy support, or through Meteor OSS by emailing security@meteor.com, following our security policy.
GitHub issues are also open for non-sensitive bugs, upgrade regressions and collaboration. Please report suspected vulnerabilities privately first, so we can investigate, prepare fixes and coordinate disclosure before publishing details that could put applications at risk.
Support the work behind these releases
Thank you to our Supernova sponsors, Galaxy and Input Logic, and our Nebula sponsor, CodeRabbit, for their ongoing support of Meteor.
Keeping Meteor a viable, secure choice for your web, Android and iOS applications takes sustained maintenance, testing and security work. Our sponsors help make that possible, alongside the contributors who report issues, review changes and test releases.
If Meteor is part of your product or your company’s infrastructure, consider supporting the framework through the Meteor Sponsorship Program. Sponsorship helps sustain the people and ongoing work behind the platform your applications depend on. Testing, contributions and responsible security reports are valuable ways to support that work too.