When will Static Web Apps managed Functions get Node.js 22.23.4 (October 2026 security release)?

Question

I have a Static Web App with a managed Functions API configured with:

"platform": { "apiRuntime": "node:22" }

On 21 October 2026 the Node.js project released security fixes for several CVEs, including high-severity CVE-2026-105482, CVE-2026-106069 and CVE-2026-111497. The fixed Node.js 22 release is v22.23.4: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

A deployment on 23 October 2026 via Azure/static-web-apps-deploy@v1 built the API with Node.js 22.23.2, according to the Oryx build log:

Detected following platforms:
  nodejs: 22.23.2
Function Runtime Information. OS: linux, Functions Runtime: ~4, node version: 22

Questions:

1. Is there a published timeline for Node.js 22.23.4 or later in the Static Web Apps build environment and managed Functions runtime?
2. Is the runtime Node version the same as the build version shown in the Oryx log, or patched on a separate schedule?
3. After the rollout, do I need to redeploy to pick up the patched runtime, or is it applied automatically?

Answer 1

Hello @Toby Beevers

On October 24, 2026, the Azure App Service team confirmed that the rollout of the applicable Node.js security fixes is complete for Azure Static Web Apps managed Functions, including the October 21 security updates. Oryx build-time Node.js and the managed Functions runtime are separate environments. https://azure.github.io/AppService/2026/10/23/time-zone-runtime-certificate-updates-azure-functions.html

Answering your questions:

1. Build environment: The Oryx Node.js version manifest now includes 22.23.4 github.com/microsoft/Oryx/blob/…/versionsToBuild.txt?…. However, this does not guarantee that the updated Oryx build image has reached your Static Web Apps deployment service.
2. Runtime version: The managed Functions runtime is patched independently of the Oryx build environment. Microsoft has confirmed completion of the applicable security rollout, but recommends verifying the actual version in the running worker.
3. Redeployment: The managed runtime security update is platform-managed and should not require redeploying your application solely to receive the patch. However, rebuilding/redeploying is appropriate if you also need to update application dependencies or produce new build artifacts.

Verify process.version inside your deployed managed Function now. If it still reports a version earlier than 22.23.4, open an Azure Static Web Apps support case referencing Microsoft's October 24 rollout completion announcement, and include the resource region, UTC timestamp, and observed version.

Official docs:

• Azure Functions and Static Web Apps security rollout October 24, 2026 https://azure.github.io/AppService/2026/10/23/time-zone-runtime-certificate-updates-azure-functions.html
• Supported Static Web Apps runtimes https://learn.microsoft.com/en-us/azure/static-web-apps/languages-runtimes
• Static Web Apps build configuration https://learn.microsoft.com/en-us/azure/static-web-apps/build-configuration