Azure Functions Linux Consumption: how to get Node.js 22.23.4 for CVE-2026-111497?

lk-di 0 Reputation points
2026-10-23T13:02:16.2+00:00

We run two Azure Function Apps in West Europe on the classic Linux Consumption plan (Y1/Dynamic, not Flex Consumption):

  • subscription: e6e530d0-bab6-4139-90a5-8fd122170ee8

Both use the platform-managed runtime with linuxFxVersion set to NODE|22. Startup logs from process.version on 23 October 2026 at approximately 12:28 UTC still reported v22.23.2 in both apps.

Node.js 22.23.4 fixes CVE-2026-111497 (Brotli decoder out-of-bounds write). The 22 October App Service Linux announcement says patched images are available through the Latest Platform Release Channel.

What is the rollout ETA for Node.js 22.23.4 or newer on Linux Consumption Functions in West Europe? Is there a supported way to receive the patch sooner, and does the Latest Platform Release Channel apply to this specific hosting plan? Would restarting or redeploying help, or must we wait for the platform rollout? If the patched runtime is not yet available, what mitigation does Microsoft recommend?

Thank you!

Azure Functions
Azure Functions

An Azure service that provides an event-driven serverless compute platform.

0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.