Hi everyone, as you know today we have had a bunch of security vulnerabilities happening.
Node.js released security fixes on October 21 for Node 22, 24 and 26 [advisory]( Node.js — Wednesday, October 21, 2026 Security Releases ). They fix four high-severity issues, including:
- a Brotli decoder out-of-bounds write that can lead to remote code execution;
- TLS certificate hostname-verification bypasses.
The fixed versions are 22.23.4, 24.22.1 and 26.12.1.
Meteor bundles its own Node. Meteor 3.5.3 ships Node 24.15.0, which is affected, and there’s no Meteor release with the patched Node yet.
At Quave we maintain the `zcloudws/meteor-node-runtime` and `zcloudws/meteor-node-mongodb-runtime` Docker images. We know a lot of Meteor developers use them outside Quave ONE, in their own Kubernetes clusters, VMs or CI. So we published patched versions for everyone, not only our customers.
**What changed**
These are the same images, with only the `node` binary replaced by the official Node.js 24.22.1 build:
- The build checks the Node.js release signature against the official [nodejs/release-keys]( GitHub - nodejs/release-keys: Node.js release signing keys. · GitHub ) and checks the binary’s SHA256.
- npm, MongoDB tools and the startup scripts are untouched.
- Node stays on major version 24, so native npm modules keep working without a rebuild.
**New tags**
```
zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1
zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools
zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools-ffmpeg
zcloudws/meteor-node-runtime:3.5.3-node24.22.1
zcloudws/meteor-node-runtime:3.5.3-node24.22.1-with-tools
zcloudws/meteor-node-runtime:3.5.3-node24.22.1-with-tools-ffmpeg
```
**How to use**
Change the `FROM` of your runtime stage:
```dockerfile
# before
FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-with-tools
# after
FROM zcloudws/meteor-node-mongodb-runtime:3.5.3-node24.22.1-with-tools
```
You can confirm with `node -v` inside the container.
The regular `3.5.3` tags are unchanged. They still match exactly what Meteor ships, which is what Meteor’s tests run on. These hotfix tags only bridge the gap until Meteor releases with the patched Node; when it does, update Meteor as usual and go back to the regular tags.
**Other Meteor versions**
Right now we published 3.5.3 only. If you need another version (for example 3.4.x or 3.3.x, which use Node 22), open an issue in the [repo]( GitHub - zcloud-ws/zcloud-community-images · GitHub ) or reply here, and we’ll publish it. The build scripts are in the same repo under `meteor-tools/node-hotfix/` if you want to check how the images are built, or build them yourself.
We already run Quave ONE in production on these images.
See you.