Check Node.js and Ruby security updates
Compare the runtime serving your application with the Node.js and Ruby October security advisories.
Originally posted · Published here · 2 sources · Resume reading
Node.js and Ruby published October security fixes for different input-processing bugs. Check the runtime used by your deployed application, including container images and background workers, before deciding the machine is patched.
Check the Node.js release line
The Node.js advisory lists fixes in 22.23.4, 24.22.1 and 26.12.1. It includes the Brotli decoder vulnerability CVE-2026-111497 alongside other fixes. Use a current patched release on a supported line and compare any vendor-maintained package with that vendor's notice. [1]
Check Ruby pattern compilation
Ruby's advisory recommends 4.0.9, 3.4.12 or 3.3.13 or later. It explains that these bugs require compiling a regular expression from attacker-controlled text; ordinary developer-written patterns are not affected. [2]
A regex timeout does not prevent these compilation bugs. If an upgrade is temporarily unavailable, Ruby recommends avoiding compilation of untrusted patterns. [2]
After updating, restart the application processes and confirm which runtime they loaded. Keep that deployed version in your update record, rather than relying only on the version your terminal finds.
Keep this guide
Sources
- Node.js October security releasesnodejs.org
- Ruby regular expression compilation fixesruby-lang.org
Next in this stack
Keyword MERGEGATE
Run five checks before merging AI-written code
Keyword DEPGATE
Check packages before trusting an AI suggestion
Keyword ACTIONGATE
Check GitHub Actions before merging workflows