Following the October 21 Node.js security advisory, we updated Atmos Pro's runtime configuration to require a patched Node.js 24 release as a precautionary hardening measure. This response complements the WAF protections Vercel deployed on October 21 against known inbound exploit patterns for the Brotli decoder vulnerability, CVE-2026-111497. Vercel controls the patch versions deployed to its managed functions; changing our configuration does not establish that its runtime rollout is complete.
The Node.js security release addresses a Brotli decoder vulnerability that can allow memory disclosure or remote code execution when an application decompresses attacker-controlled data, along with other security issues.
Vercel's WAF protections cover known inbound attack patterns in traffic passing through its network. They do not cover malicious responses an application fetches from other servers. Runtime patching addresses that additional exposure.
Vercel also manages security patch updates for its supported Node.js runtimes. Its advisory describes that rollout as ongoing; this bulletin does not assert that the platform-wide rollout is complete.
Upgraded Atmos Pro's runtime requirement to Node.js 24.22.1 or newer within the Node.js 24 release line, which includes the October security fixes.
Aligned local development, CI, and shared tooling with the patched runtime requirement.
Added runtime-version logging to support deployment verification. Our release checks cover installation, type checking, tests, and production builds, with particular attention to authentication, background jobs, and image and PDF rendering.
The upgrade is a precautionary measure alongside Vercel's existing mitigations. WAF protections and runtime patching address different parts of the exposure, so we include both in our response.
No customer configuration changes are required for this managed-service runtime upgrade. Customers operating their own Node.js applications should review the upstream advisory and apply the appropriate security updates to those environments.
