Node browser runtime release notes | New Relic Documentation

November 5

Security patches

Library vulnerabilities:

CVE-2026-116689
CVE-2026-118773
CVE-2026-118772
CVE-2026-118764

October 29

Important

New Relic analyse l'image d'exécution du navigateur Node à la recherche de vulnérabilités chaque jour et publie une sortie corrigée chaque jeudi. Chaque sortie inclut des correctifs pour les CVE du système d’exploitation, de l’application, et de Chrome identifiées au plus tard le mardi à 18:29 UTC de cette semaine-là. Si nous identifions une CVE après cette heure, le correctif est publié dans la sortie du jeudi de la semaine suivante.

Nous publions chaque sortie sur le tag latest, qui exécute Node.js 22 et la dernière version stable de Chrome. Les sites privés qui utilisent latest reçoivent les correctifs automatiquement. Si vous utilisez un tag de version spécifique, mettez à jour manuellement vers la version la plus récente pour obtenir les correctifs actuels.

Améliorations et optimisations

Mise à niveau de Chrome de 154.0.8037.57-1 vers 156.0.8078.47-1

Correctifs de sécurité

Vulnérabilités de la bibliothèque :

Mise à niveau d'undici vers 7.30.1 (6.29.1 dans npm) : CVE-2026-109383, CVE-2026-109829, CVE-2026-109841, CVE-2026-109869, CVE-2026-109924, CVE-2026-109932, CVE-2026-87018, CVE-2026-87029
Mise à jour de ip-address vers 10.7.5 (10.7.4 dans npm) : CVE-2026-111997
Mise à niveau de nodemailer vers 10.2.1 : GHSA-85x2-q946-cp5h, GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-4ffr-jq9g-5ffx, GHSA-g73g-hqqh-jr95
Mise à niveau de qs vers 6.16.1 : CVE-2026-110816

Vulnérabilités du système d'exploitation :

Mise à jour de zlib1g vers 1:1.3.dfsg-3.1ubuntu2.3 : CVE-2026-85091
Mise à jour de libbrotli1 : CVE-2026-111497

Certificats CA :

Résolution de la compromission de l'autorité de certification eMudhra en retirant l'approbation des certificats racines eMudhra (emSign) et de la racine Comodo AAA Certificate Services du bundle CA du système d'exploitation et des magasins de clés respectifs.

October 22

Node browser runtime v3.0.256

Improvements

Upgraded node version 22.20.0 to 22.23.4 (fixes critical node CVEs)

Security patches

Fixed the following vulnerabilities:

OS vulnerabilities:

CVE-2026-16517
CVE-2026-19033
CVE-2026-19662
CVE-2026-19666
CVE-2026-19667
CVE-2026-19668
CVE-2026-19941
CVE-2026-46675
CVE-2026-75029
CVE-2026-76781
CVE-2026-77119
CVE-2026-78301
CVE-2026-80274
CVE-2026-81563
CVE-2026-81736
CVE-2026-86138
CVE-2026-86142
CVE-2026-86143
CVE-2026-86144
CVE-2026-88806
CVE-2026-94283
CVE-2026-94284
CVE-2026-94285
CVE-2026-96512

Library vulnerabilities:

CVE-2026-111755
CVE-2026-111756
CVE-2026-111497
CVE-2026-106069
CVE-2026-105483
CVE-2026-105482
CVE-2026-105481
CVE-2026-106072
CVE-2026-106074
CVE-2026-106070
CVE-2026-106071
CVE-2026-106073

October 8

Node browser runtime v3.0.249

Security patches

OS vulnerabilities:

CVE-2026-35189
CVE-2026-54872
CVE-2026-75805
CVE-2026-75806
CVE-2026-77696
CVE-2026-84384
CVE-2026-84447
CVE-2026-84448
CVE-2026-84449
CVE-2026-84782
CVE-2026-86219
CVE-2026-94287
CVE-2026-95512
CVE-2026-96889

Library vulnerabilities:

CVE-2026-104844

September 28

Node browser runtime v3.0.244

Bug fixes

Fixed 12–30 second click delays on Angular and Zone.js applications. The Synthetics browser extension is now loaded via CDP WebSocket (Extensions.loadUnpacked) instead of BiDi (webExtension.install). Chrome 153+ BiDi introduced a "Waiting for pending navigations" check after every click that stalled responses on apps with pending macrotasks. Switching to CDP keeps BiDi out of the session, restoring ChromeDriver's classic sub-millisecond document.readyState navigation check.

September 24

Node browser runtime v3.0.241

Security patches

Upgraded Chrome from version 153.0.8010.47-1 to 154.0.8037.57-1.

OS vulnerabilities:

CVE-2025-59375
CVE-2026-15588
CVE-2026-16118
CVE-2026-32776
CVE-2026-32777
CVE-2026-32778
CVE-2026-39919
CVE-2026-41080
CVE-2026-45186
CVE-2026-50219
CVE-2026-56403
CVE-2026-56404
CVE-2026-56405
CVE-2026-56408
CVE-2026-56412
CVE-2026-58010
CVE-2026-58011
CVE-2026-58012
CVE-2026-58013
CVE-2026-58014
CVE-2026-58015
CVE-2026-58016
CVE-2026-74860
CVE-2026-82474
CVE-2026-86140

Library vulnerabilities:

CVE-2026-17495
CVE-2026-18149
CVE-2026-18540
CVE-2026-19534
CVE-2026-77301
CVE-2026-84890
CVE-2026-84933
CVE-2026-84947
CVE-2026-84961
CVE-2026-85008
CVE-2026-85014
CVE-2026-85024
CVE-2026-90771
CVE-2026-90776
CVE-2026-92000
CVE-2026-92599

September 17

Node browser runtime v3.0.234

Bug fixes

Fixed deepStrictEqual/strictEqual failures on $webDriver/$ browser return values caused by a vm-realm prototype mismatch for scripted-browser monitors

Security patches

Upgraded Chrome from version 152.0.7977.82-1 to 153.0.8010.47-1.

OS vulnerabilities:

CVE-2026-56208
CVE-2026-56209
CVE-2026-56210
CVE-2026-56211

September 15

Node browser runtime v3.0.228

Enhancements

Added AbortController and AbortSignal as available host globals in the Scripted Browser monitor runtime sandbox.

Bug fixes

Removed the --jitless Chrome JS flag to re-enable JIT compilation, improving script execution performance for Scripted Browser monitors.

September 10

Node browser runtime v3.0.220

Bug fixes

Fixed a Chrome initialization delay of up to 5 minutes on private locations by bypassing Selenium Manager outbound ChromeDriver discovery calls and setting the ChromeDriver path explicitly.

Security patches

Strengthened script sandbox isolation for Scripted Browser Monitor runtime by migrating to vm.runInNewContext for robust V8 context separation.

Upgraded Chrome from version 152.0.7977.64-1 to 152.0.7977.82-1.

Fixed the following vulnerabilities:

OS vulnerabilities:

CVE-2026-46275
CVE-2026-53357
CVE-2026-64015
CVE-2026-64018
CVE-2026-64032
CVE-2026-64073
CVE-2026-64115
CVE-2025-71289
CVE-2026-23469
CVE-2026-31420
CVE-2026-31486
CVE-2026-31560
CVE-2026-46158
CVE-2026-46170
CVE-2026-46315
CVE-2026-52912
CVE-2026-52915
CVE-2026-52916
CVE-2026-52918
CVE-2026-52919
CVE-2026-52921
CVE-2026-52922
CVE-2026-52926
CVE-2026-52941
CVE-2026-64025
CVE-2026-64029
CVE-2026-64033
CVE-2026-64039
CVE-2026-64046
CVE-2026-64047
CVE-2026-64048
CVE-2026-64051
CVE-2026-64055
CVE-2026-64056
CVE-2026-64064
CVE-2026-64083
CVE-2026-64084
CVE-2026-64085
CVE-2026-64086
CVE-2026-64087
CVE-2026-64088
CVE-2026-64089
CVE-2026-64092
CVE-2026-64096
CVE-2026-64097
CVE-2026-64098
CVE-2026-64102
CVE-2026-64106
CVE-2026-64108
CVE-2026-64109
CVE-2026-64111
CVE-2026-64113
CVE-2026-64114
CVE-2026-64116
CVE-2026-64118
CVE-2026-64121
CVE-2026-64125
CVE-2026-64126
CVE-2026-64127
CVE-2026-64128
CVE-2026-64133
CVE-2026-64134
CVE-2026-64135
CVE-2026-64136
CVE-2026-64137
CVE-2026-64138
CVE-2026-64144
CVE-2026-64147
CVE-2026-64148
CVE-2026-64155
CVE-2026-64163
CVE-2026-64165
CVE-2026-64166
CVE-2026-64168
CVE-2026-64170
CVE-2026-64173
CVE-2026-64174
CVE-2026-64177
CVE-2026-64178
CVE-2026-64179
CVE-2026-64180
CVE-2026-64182
CVE-2026-64183
CVE-2026-64184
CVE-2026-64185
CVE-2026-64214
CVE-2026-64217
CVE-2026-64218
CVE-2026-64219
CVE-2026-64220
CVE-2026-64221
CVE-2026-64225
CVE-2026-64231
CVE-2026-64518
CVE-2026-57062
CVE-2026-64034
CVE-2026-64103
CVE-2026-64153

Library vulnerabilities:

CVE-2026-84367
CVE-2026-84368
CVE-2026-84375
GHSA-2x7j-588g-ccc2
GHSA-8m3c-c648-2xjj
GHSA-cc9r-2j5m-2m83
GHSA-wmmp-3585-3rmp
GHSA-x5fp-wj9c-mxmx
GHSA-4mjr-xmp4-gh2g
CVE-2026-82417
CVE-2026-82562

Security patches.css-21sua1{background:none;border:none;width:0;padding:0;}

Important

Améliorations et optimisations

Correctifs de sécurité

Improvements

Security patches

Security patches

Bug fixes

Security patches

Bug fixes

Security patches

Enhancements

Bug fixes

Bug fixes

Security patches

Security patches