Node browser runtime release notes | New Relic Documentation

October 29

重要

New Relic scans the Node browser runtime image for vulnerabilities every day and publishes a patched release every Thursday. Each release includes fixes for operating system, application, and Chrome CVEs identified by Tuesday 6:29 PM UTC of that week. If we identify a CVE after that time, the fix ships in the following week's Thursday release.

We publish every release to the latest tag, which runs Node.js 22 and the latest stable version of Chrome. Private locations that use latest get fixes automatically. If you use a specific version tag, manually update to the newest version to get current fixes.

Improvements and enhancements

Upgraded Chrome from 154.0.8037.57-1 to 156.0.8078.47-1

Security patches

Library vulnerabilities:

Upgraded undici to 7.30.1 (6.29.1 inside npm): CVE-2026-109383, CVE-2026-109829, CVE-2026-109841, CVE-2026-109869, CVE-2026-109924, CVE-2026-109932, CVE-2026-87018, CVE-2026-87029
Upgraded ip-address to 10.7.5 (10.7.4 inside npm): CVE-2026-111997
Upgraded nodemailer to 10.2.1: GHSA-85x2-q946-cp5h, GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-4ffr-jq9g-5ffx, GHSA-g73g-hqqh-jr95
Upgraded qs to 6.16.1: CVE-2026-110816

OS vulnerabilities:

Updated zlib1g to 1:1.3.dfsg-3.1ubuntu2.3: CVE-2026-85091
Updated libbrotli1: CVE-2026-111497

CA certificates:

Addressed the eMudhra certificate authority compromise by removing trust for the eMudhra (emSign) root certificates and the Comodo AAA Certificate Services root from the OS CA bundle and the respective keystores

October 22

Node browser runtime v3.0.256

Improvements

Upgraded node version 22.20.0 to 22.23.4 (fixes critical node CVEs)

Security patches

Fixed the following vulnerabilities:

OS vulnerabilities:

CVE-2026-16517
CVE-2026-19033
CVE-2026-19662
CVE-2026-19666
CVE-2026-19667
CVE-2026-19668
CVE-2026-19941
CVE-2026-46675
CVE-2026-75029
CVE-2026-76781
CVE-2026-77119
CVE-2026-78301
CVE-2026-80274
CVE-2026-81563
CVE-2026-81736
CVE-2026-86138
CVE-2026-86142
CVE-2026-86143
CVE-2026-86144
CVE-2026-88806
CVE-2026-94283
CVE-2026-94284
CVE-2026-94285
CVE-2026-96512

Library vulnerabilities:

CVE-2026-111755
CVE-2026-111756
CVE-2026-111497
CVE-2026-106069
CVE-2026-105483
CVE-2026-105482
CVE-2026-105481
CVE-2026-106072
CVE-2026-106074
CVE-2026-106070
CVE-2026-106071
CVE-2026-106073

October 8

Node browser runtime v3.0.249

Security patches

OS vulnerabilities:

CVE-2026-35189
CVE-2026-54872
CVE-2026-75805
CVE-2026-75806
CVE-2026-77696
CVE-2026-84384
CVE-2026-84447
CVE-2026-84448
CVE-2026-84449
CVE-2026-84782
CVE-2026-86219
CVE-2026-94287
CVE-2026-95512
CVE-2026-96889

Library vulnerabilities:

CVE-2026-104844

September 28

Node browser runtime v3.0.244

バグ修正

AngularおよびZone.jsアプリケーションでの12～30秒のクリック遅延を修正しました。外形監視ブラウザ拡張機能は、BiDi（webExtension.install）ではなくCDP WebSocket（Extensions.loadUnpacked）経由で読み込まれるようになりました。Chrome 153以降のBiDiでは、クリックのたびに「Waiting for pending navigations」チェックが導入され、保留中のマクロタスクがあるアプリの応答が停止していました。CDPに切り替えることで、BiDiをセッションから除外し、ChromeDriverの従来の1ミリ秒未満のdocument.readyStateナビゲーションチェックを復元します。

September 24

Node browser runtime v3.0.241

Security patches

Upgraded Chrome from version 153.0.8010.47-1 to 154.0.8037.57-1.

OS vulnerabilities:

CVE-2025-59375
CVE-2026-15588
CVE-2026-16118
CVE-2026-32776
CVE-2026-32777
CVE-2026-32778
CVE-2026-39919
CVE-2026-41080
CVE-2026-45186
CVE-2026-50219
CVE-2026-56403
CVE-2026-56404
CVE-2026-56405
CVE-2026-56408
CVE-2026-56412
CVE-2026-58010
CVE-2026-58011
CVE-2026-58012
CVE-2026-58013
CVE-2026-58014
CVE-2026-58015
CVE-2026-58016
CVE-2026-74860
CVE-2026-82474
CVE-2026-86140

Library vulnerabilities:

CVE-2026-17495
CVE-2026-18149
CVE-2026-18540
CVE-2026-19534
CVE-2026-77301
CVE-2026-84890
CVE-2026-84933
CVE-2026-84947
CVE-2026-84961
CVE-2026-85008
CVE-2026-85014
CVE-2026-85024
CVE-2026-90771
CVE-2026-90776
CVE-2026-92000
CVE-2026-92599

September 17

Node browser runtime v3.0.234

Bug fixes

Fixed deepStrictEqual/strictEqual failures on $webDriver/$ browser return values caused by a vm-realm prototype mismatch for scripted-browser monitors

Security patches

Upgraded Chrome from version 152.0.7977.82-1 to 153.0.8010.47-1.

OS vulnerabilities:

CVE-2026-56208
CVE-2026-56209
CVE-2026-56210
CVE-2026-56211

September 15

Node browser runtime v3.0.228

Enhancements

Added AbortController and AbortSignal as available host globals in the Scripted Browser monitor runtime sandbox.

Bug fixes

Removed the --jitless Chrome JS flag to re-enable JIT compilation, improving script execution performance for Scripted Browser monitors.

September 10

Node browser runtime v3.0.220

Bug fixes

Fixed a Chrome initialization delay of up to 5 minutes on private locations by bypassing Selenium Manager outbound ChromeDriver discovery calls and setting the ChromeDriver path explicitly.

Security patches

Strengthened script sandbox isolation for Scripted Browser Monitor runtime by migrating to vm.runInNewContext for robust V8 context separation.

Upgraded Chrome from version 152.0.7977.64-1 to 152.0.7977.82-1.

Fixed the following vulnerabilities:

OS vulnerabilities:

CVE-2026-46275
CVE-2026-53357
CVE-2026-64015
CVE-2026-64018
CVE-2026-64032
CVE-2026-64073
CVE-2026-64115
CVE-2025-71289
CVE-2026-23469
CVE-2026-31420
CVE-2026-31486
CVE-2026-31560
CVE-2026-46158
CVE-2026-46170
CVE-2026-46315
CVE-2026-52912
CVE-2026-52915
CVE-2026-52916
CVE-2026-52918
CVE-2026-52919
CVE-2026-52921
CVE-2026-52922
CVE-2026-52926
CVE-2026-52941
CVE-2026-64025
CVE-2026-64029
CVE-2026-64033
CVE-2026-64039
CVE-2026-64046
CVE-2026-64047
CVE-2026-64048
CVE-2026-64051
CVE-2026-64055
CVE-2026-64056
CVE-2026-64064
CVE-2026-64083
CVE-2026-64084
CVE-2026-64085
CVE-2026-64086
CVE-2026-64087
CVE-2026-64088
CVE-2026-64089
CVE-2026-64092
CVE-2026-64096
CVE-2026-64097
CVE-2026-64098
CVE-2026-64102
CVE-2026-64106
CVE-2026-64108
CVE-2026-64109
CVE-2026-64111
CVE-2026-64113
CVE-2026-64114
CVE-2026-64116
CVE-2026-64118
CVE-2026-64121
CVE-2026-64125
CVE-2026-64126
CVE-2026-64127
CVE-2026-64128
CVE-2026-64133
CVE-2026-64134
CVE-2026-64135
CVE-2026-64136
CVE-2026-64137
CVE-2026-64138
CVE-2026-64144
CVE-2026-64147
CVE-2026-64148
CVE-2026-64155
CVE-2026-64163
CVE-2026-64165
CVE-2026-64166
CVE-2026-64168
CVE-2026-64170
CVE-2026-64173
CVE-2026-64174
CVE-2026-64177
CVE-2026-64178
CVE-2026-64179
CVE-2026-64180
CVE-2026-64182
CVE-2026-64183
CVE-2026-64184
CVE-2026-64185
CVE-2026-64214
CVE-2026-64217
CVE-2026-64218
CVE-2026-64219
CVE-2026-64220
CVE-2026-64221
CVE-2026-64225
CVE-2026-64231
CVE-2026-64518
CVE-2026-57062
CVE-2026-64034
CVE-2026-64103
CVE-2026-64153

Library vulnerabilities:

CVE-2026-84367
CVE-2026-84368
CVE-2026-84375
GHSA-2x7j-588g-ccc2
GHSA-8m3c-c648-2xjj
GHSA-cc9r-2j5m-2m83
GHSA-wmmp-3585-3rmp
GHSA-x5fp-wj9c-mxmx
GHSA-4mjr-xmp4-gh2g
CVE-2026-82417
CVE-2026-82562

September 3

Node browser runtime v3.0.215

Security patches

Upgraded Chrome from version 151.0.7922.173-1 to 152.0.7977.64-1.

Fixed the following vulnerabilities:

OS vulnerabilities:

CVE-2024-2236
CVE-2025-5278
CVE-2025-6141
CVE-2025-15649
CVE-2026-7017
CVE-2026-9538
CVE-2026-12087
CVE-2026-13221
CVE-2026-13595
CVE-2026-13757
CVE-2026-18938
CVE-2026-27171
CVE-2026-27456
CVE-2026-42250
CVE-2026-48959
CVE-2026-48962
CVE-2026-53612
CVE-2026-53613
CVE-2026-53614
CVE-2026-53615
CVE-2026-53910
CVE-2026-54371
CVE-2026-57432
CVE-2026-57433
CVE-2026-59843
CVE-2026-59845
CVE-2026-59846
CVE-2026-59847
CVE-2026-59848
CVE-2026-59850
CVE-2026-62291

Library vulnerabilities:

CVE-2026-55553

重要

Improvements and enhancements.css-21sua1{background:none;border:none;width:0;padding:0;}

Security patches

Improvements

Security patches

Security patches

バグ修正

Security patches

Bug fixes

Security patches

Enhancements

Bug fixes

Bug fixes

Security patches

Security patches

Improvements and enhancements