[NEXT-SECURITY-RELEASE] Heads up on upcoming Node.js security release 2025/12/15

[marco-ippolito]

As per security release workflow, creating issue to give the docker team a heads up.

[MikeMcC399]

@marco-ippolito

The security release has been delayed multiple times so that it is now going to be almost one month late (see https://nodejs.org/en/blog/vulnerability/december-2025-security-releases).

Will the release only address the security issues mentioned or it is going to include also other commits, such as an update to the version of npm?

[marco-ippolito]

It will include a few more commits

[RafaelGSS]

Security release is now available.

[adrianvaillant]

Will all of the supported images be updated rather soon? I kind of expected to have the new images by the time it got public to update immediately but it seems its not the case yet

[marco-ippolito]

Security release is out

[latentflip]

Also waiting for the builds to be updated in docker and surprised they aren't there. I have no idea how this process works, but it looks like the action that opens the automated PR with the updates is getting blocked by the fact that the latest versions don't have a "musl" release yet on https://unofficial-builds.nodejs.org/download/release/index.json.

Maybe that's just normal and something that takes time? The fact it's "unofficial" makes me wonder though if a step has been missed? Or do we just have to wait?

[takumi0706]

@latentflip You're right - unofficial-builds is missing the musl builds for this security release.

Version	Official	unofficial-builds
v20	20.20.0	20.19.6
v22	22.22.0	22.21.1
v24	24.13.0	24.12.0
v25	25.3.0	25.3.0 ✓

I've opened nodejs/unofficial-builds#199 to request the missing builds.

[MikeMcC399]

Would it be possible, in general and for future releases, to de-couple the release of official builds from unofficial builds, so that releasing official builds is never held up because of problems with prerequisites for unofficial builds?

https://github.com/nodejs/unofficial-builds/ links to https://unofficial-builds.nodejs.org/ and shows:

[switz]

Yeah, this really needs to be cut alongside the release if possible - many people deploy to production on these images. There should be coordination here.

[yzhe554]

@latentflip You're right - unofficial-builds is missing the musl builds for this security release.

Version	Official	unofficial-builds
v20	20.20.0	20.19.6
v22	22.22.0	22.21.1
v24	24.13.0	24.12.0
v25	25.3.0	25.3.0 ✓

I've opened nodejs/unofficial-builds#199 to request the missing builds.

25.3.0 and 22.22.0 have done. It's building 20.20.0 now

[mdavidsen]

It looks like v24 is being built right now. Everything else has finished.

20.20 is still building, and 24 is still not started according to https://unofficial-builds.nodejs.org/logs/

[Diesmon]

Can someone point me to documentation that explains the rough workflow for a new docker NodeJS release so I can understand this unofficial/official build problem better?

Because I'm a bit shocked to learn that NodeJS docker images are not available for around 24h after CVE fixes got released + the big blog entry dropped that urges to update ASAP.

I would have assumed that the docker images are published either together or a few hours after the binaries dropped, as they are understandably needed for the docker images themselves.

[loganaden]

A lot of apps are still on 20 LTS releases.

[ItsHarta]

Can someone point me to documentation that explains the rough workflow for a new docker NodeJS release so I can understand this unofficial/official build problem better?

Because I'm a bit shocked to learn that NodeJS docker images are not available for around 24h after CVE fixes got released + the big blog entry dropped that urges to update ASAP.

I would have assumed that the docker images are published either together or a few hours after the binaries dropped, as they are understandably needed for the docker images themselves.

Code is inspectable in this repo, nodejs/docker-node/build-automation.mjs. to put it short, the -alpine variant requires MUSL build from the unofficial repo. If for some reason this MUSL build does not exist for that version (e.g., 22.x), all variants of that version is deferred/skipped (this includes all debian & debian-slim). This is probably to prevent the split-version scenario (e.g., 22-alpine points to 22.21.1 while 22-trixie points to 22.22.0)

The unofficial build is slow and sequential. as of now 20.20 is still running and 24.13 is in queue

[bmuenzenmeyer]

Can someone point me to documentation that explains the rough workflow for a new docker NodeJS release so I can understand this unofficial/official build problem better?

I opened #2345

edit (my two cents as a website maintainer):

Because I'm a bit shocked to learn that NodeJS docker images are not available for around 24h after CVE fixes got released + the big blog entry dropped that urges to update ASAP.

I would have assumed that the docker images are published either together or a few hours after the binaries dropped, as they are understandably needed for the docker images themselves.

Glad there is recognition of chicken and egg here. Yes, there will always be a critical path of infrastructure that coincides with any release. They stack up then when a security event creates four. I suppose the blog post could wait until after docker is ready, but then we are not communicating availability. On balance, that might be better, given the creation of urgency in the current sequencing. I've shared this feedback and thread with a broader team.