Emergency Node.js and Python Runtime Updates on Azure App Service for Linux

Update (22 October 2026): We have completed the rollout of the updated built-in Node.js and Python images to the Latest Platform Release Channel for Azure App Service on Linux. If you need the fixes now, move your app to Latest. The Standard channel will receive the updates through our Safe Deployment Practices (SDP) rollout.

Following the emergency Node.js and Python releases on 21 October 2026, the Azure App Service team has updated the built-in Linux images with the newly released runtime versions.

Patched versions and official release notes

The following versions were published by the Node.js and Python projects on 21 October 2026. These are upstream release versions; verify the runtime version in your running App Service app using the instructions below.

Node.js

For the 22.x and 24.x release lines covered in this article, the official Node.js security announcement lists fixes with a highest severity of High, including fixes for a Brotli decoder out-of-bounds write that permits remote code execution, DNS name handling, and TLS certificate hostname validation. The release also includes dependency updates and a CA-certificate update related to the eMudhra intermediate CA compromise.

Node.js release line	Patched version	Official release notes
22.x	22.23.4	Node.js 22.23.4
24.x	24.22.1	Node.js 24.22.1

See the official security announcement for the complete vulnerability list and affected release lines. End-of-life Node.js versions do not receive these fixes; move to a supported release line if your app is using an EOL version.

Python

The official Python release announcement describes an expedited security release for 3.14 and a special security release for 3.13. Both update bundled pip to 26.2.2, including certifi 2026.10.19, to address the eMudhra / emSign CA certificate security incident.

Python release line	Updated version	Official release notes
3.13	3.13.17	Python 3.13.17
3.14	3.14.9	Python 3.14.9

Updating the platform runtime does not update packages in your app’s existing virtual environments. The Python team also recommends updating pip and uv in existing virtual environments. Review the official incident guidance, update affected app-managed dependencies through your trusted package source, and rebuild and redeploy your app as needed.

What we are doing

The updated images roll out through the Platform Release Channels as follows:

Channel	Availability of the updates
Latest	Rollout complete. Move to this channel if you need the fixes now.
Standard (default)	Will receive the updates through the Safe Deployment Practices (SDP) rollout.

The completed rollout to Latest does not mean that the updated images are available on Standard yet.

Changing your Platform Release Channel does not change your app’s configured Node.js or Python release line. If your app needs a different supported release line, update and test the app and change its runtime configuration separately.

What you should do

1. Move to Latest if you need the fixes now. For apps using the built-in Node.js or Python runtimes on App Service for Linux, select the Latest Platform Release Channel using the instructions below.
2. Verify your runtime version. After your app picks up the updated image, use az webapp exec to open an interactive shell in the app and check its running runtime version.
3. Update custom containers and bring-your-own runtimes yourself. App Service does not patch Node.js or Python runtimes that you supply. Update your runtime or rebuild your container image with the applicable fixed version, test your app, and redeploy.

Change your Platform Release Channel

Azure portal

1. In the Azure portal, go to your App Service app.
2. In the left menu, select Stack settings.
3. Under Platform Release Channel, select Latest.
4. Select Save.

Azure CLI

Use az webapp update to move your app to Latest:

az webapp update \
  --resource-group <resource-group> \
  --name <app-name> \
  --platform-release-channel Latest

Replace the placeholders with your app’s resource group and name. For a deployment slot, add --slot <slot-name>.

If your app remains on Standard, it will receive the updates as the SDP rollout progresses. To pick up the updates already available on Latest, change your app’s channel to Latest.

For more information, see OS and runtime patching in Azure App Service.

Verify your runtime version

Use az webapp exec (currently in preview) with Azure CLI 2.90.0 or later to open an interactive shell in your running app:

az webapp exec --resource-group <resource-group> --name <app-name>

Replace the placeholders with your app’s resource group and name. For a deployment slot, add --slot <slot-name>.

In the interactive shell, run the command for your runtime.

For Node.js:

node --version

For Python:

python --version

Verify the version in your running app rather than relying only on the selected Platform Release Channel.

Use the interactive shell for these checks rather than detached execute mode, which does not return command output or an exit code.

Stay informed

We will share updates here as the rollout to Standard progresses.

Thank you for helping us keep your Node.js and Python apps on Azure App Service secure.