On October 21, the Node.js project released security updates addressing several vulnerabilities, including high-severity issues, across Node.js 22, 24, and 26.
The patched versions are Node.js 22.23.4, 24.22.1, and 26.12.1. You can read more in the official Node.js security advisory.
Applications on Medusa Cloud
We immediately updated the Medusa Cloud deployment pipeline to use the patched Node.js versions.
To apply these security fixes, you need to redeploy your application. Future deployments will automatically use a patched version of Node.js without requiring any code or configuration changes.
There are a few exceptions: If your application's Node.js version setting does not allow a patched release, for example, an exact version such as Copy to clipboard22.21.0 or a range restricted to Node.js 25, we'll continue respecting your configured version.
Node.js 25 has reached end-of-life and will not receive these security fixes. We recommend updating your configuration to allow a supported, patched LTS release, such as Copy to clipboard^24.22.1.
Self-hosted applications
If you run your Medusa application on your own infrastructure, you'll need to update Node.js yourself.
- Check your Node.js version. Run Copy to clipboardnode -v in your production environment. You need at least 22.23.4, 24.22.1, or 26.12.1, depending on your release line.
- Upgrade Node.js. Update to the latest patched version in your release line. If you're running Node.js 20 or 25, both of which have reached end-of-life, migrate to a supported LTS release such as Node.js 22 or 24.
- Rebuild your Docker images. If you use official Node.js images, pin the patched version (for example, Copy to clipboardnode:24.22.1-slim) or rebuild using Copy to clipboarddocker build --pull to refresh floating base image tags. Redeploy your application afterward.
- Review your Node.js version constraints. If your Copy to clipboardpackage.json specifies an outdated exact version or restrictive range in Copy to clipboardengines.node, update it to allow patched releases, for example Copy to clipboard^24.22.1.
- Check managed hosting providers. If your backend or storefront runs on a platform that manages Node.js for you, verify that it has rolled out the patched versions.
Security by default on Medusa Cloud
Security is a core part of how we build Medusa.
Our goal with Medusa Cloud is to make security the default, so merchants and developers don't have to continuously monitor vulnerabilities and manage infrastructure patches themselves.
When vulnerabilities like these are disclosed, we act quickly to update our infrastructure and reduce the operational burden on the businesses running on Medusa.
