Azure Functions Windows Consumption still running vulnerable Node 24.19.0 — when will Node 24.22.1 be available?

Hi Donnie Byrd & thx for join me at Q&A platform,

Microsoft's October 22 announcement confirms that Node.js 24.22.1 is being rolled out to Azure App Service for Windows, including updates to the built-in Node.js runtime. However, the rollout is still in progress, and Microsoft hasn't published an exact completion time for East US or individual hosting environments.

One important detail is that Windows Consumption doesn't have the Latest / Standard Platform Release Channel options available on Linux. So there's no supported channel switch u can use to get the patched runtime earlier.

Your WEBSITE_NODE_DEFAULT_VERSION=~24 setting is appropriate for selecting the Node.js 24 release line, but it doesn't guarantee that the latest patch version is already installed on the underlying host.

I'd continue checking process.version from inside the actual Functions worker process, rather than relying only on the configured runtime or a separate console session. If the app runs across multiple instances, capture the instance identifier too, bc different workers may receive platform updates at different times.

Regarding restarting, a restart won't install Node.js 24.22.1 if the patched runtime hasn't reached ur hosting infrastructure yet. Once the update is available, restarting may help ensure a new worker process picks up the updated runtime, but Microsoft hasn't documented a mandatory customer restart procedure for this rollout. I'd avoid repeatedly restarting a production Function App just to check.

For an expedited update, I'm not aware of a supported self-service mechanism to request immediate deployment of a specific Node.js patch to an individual Windows Consumption app. Microsoft would need to confirm whether any targeted mitigation or accelerated rollout is possible.

Given that ur Basic support plan doesn't include technical support cases, I'd ask a Microsoft moderator here to help route this to the Azure Functions / App Service engineering team. The request should be specific: confirm the rollout status for Windows Consumption in East US, whether an expedited security mitigation is available, and whether customers need to recycle their Function Apps after the update.

You've already collected the most useful evidence: the actual worker executable version, confirmation that 24.22.1 isn't installed on the inspected host, and the affected hosting configuration. Keep the instance details and resource identifiers private.

For now, the official October 22 App Service announcement is the best place to follow progress. Microsoft says that post will be updated when the Windows rollout is complete.

The main thing I'd want engineering to clarify is whether Windows Consumption is following the same rollout schedule as other Windows App Service hosting plans, or whether Functions Consumption has a separate deployment timeline. That would help customers assess their actual exposure instead of relying on a general Windows rollout announcement

rgds,

Alex

p.s. if my answer is help - pls mark it as an answer