Flex Consumption in East US 2 still runs Node.js v22.23.2 after the 22.23.4 release

Grey Cai 0 Reputation points
2026-10-23T10:03:50.3566667+00:00 
Product: Azure Functions
Hosting plan: Flex Consumption (Linux, SKU FC1)
Region: East US 2
Runtime: functionAppConfig.runtime name=node, version=22
linuxFxVersion: empty

A worker on this app logged the following on 10/23/2026, 6:40:49.101 AM:

Node.js runtime: v22.23.2

The app had been published earlier that day and Flex recreated the instances. The Node.js binary stayed at v22.23.2. Publishing the app again does not replace it.

We need Node.js 22.23.4 or later on the 22.x line. That is the 21 October 2026 security release. It fixes high-severity issues on 22.x, including CVE-2026-111497 (Brotli decoder out-of-bounds write), CVE-2026-106069 (TLS hostname validation), and CVE-2026-105482 (dns.resolve NUL handling).

Node.js advisory:
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

App Service for Linux says the updated built-in images, including Node.js 22.23.4, finished rolling out on the Latest and Standard channels on 22 October 2026:
https://azure.github.io/AppService/2026/10/22/node-python-emergency-release-app-service-linux.html

That post covers App Service Platform Release Channels. This app is Flex Consumption. It has no Platform Release Channel setting.

Questions:
1. Has Node.js 22.23.4 or later reached the Flex Consumption node 22 image in East US 2?
2. If not, when is it expected?
3. Is there a supported way for a Flex Consumption app to move to that patched image before the regional rollout, other than waiting?
4. After the image is available in East US 2, does a restart pick it up without publishing the app again?
Azure Functions
Azure Functions

An Azure service that provides an event-driven serverless compute platform.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-10-23T10:05:11.1866667+00:00

    No public Microsoft status confirms that Node.js 22.23.4 has reached the Azure Functions Flex Consumption image in East US 2; open an Azure Functions support request for region- and subscription-specific rollout confirmation before attempting further deployments.^1^

    Answers to the four questions

    1. Has 22.23.4 reached East US 2?
      This cannot be confirmed from the public rollout information. Your observed process.version of v22.23.2 on a newly recreated worker at 2026-10-23 06:40 UTC is direct evidence that at least the capacity serving that instance had not selected 22.23.4 at that time. It does not establish whether rollout had begun elsewhere in the region. Open Azure portal → Help + support → Create a support request, select Azure Functions, and include:
      • Function App resource ID
      • Flex Consumption, Linux, FC1
      • Region: East US 2
      • functionAppConfig.runtime: node, version 22
      • UTC timestamp and worker/instance ID
      • process.version output showing v22.23.2
      • Required minimum: Node.js 22.23.4
      • The relevant CVEs and Node.js security-advisory date
      • A request to confirm the deployed Flex image version and rollout status for this region/subscription
    2. When is it expected?
      No public Flex Consumption ETA is documented. The App Service Platform Release Channel announcement does not establish the rollout date for Flex Consumption, which is a separate hosting plan and has no release-channel selector. Microsoft Support or the Functions product team must provide the regional ETA.
    3. Can the app move early to the patched managed image?
      No documented customer-controlled mechanism is available on Flex Consumption to select a Node.js patch version or a particular managed image. Flex supports the Node.js 22 major line, not customer selection of 22.23.4 specifically.^2^ Flex Consumption also cannot target a specific Functions runtime version through FUNCTIONS_EXTENSION_VERSION. More generally, pinning a Linux Consumption app to a specific image is unsupported; image URIs should only be used when supplied by a support professional.^3^ Do not set linuxFxVersion to a guessed DOCKER|... image or use the documented App Service release-channel controls. Those are not established upgrade paths for this Flex app. Your existing functionAppConfig.runtime selection of Node.js 22 is the relevant major-version configuration. If the security deadline cannot accommodate the regional rollout, ask Support whether there is an approved mitigation or accelerated placement option. Otherwise, the architectural alternative is moving the workload to a hosting option where you maintain the container image; that is a migration, not an in-place Flex override.
    4. Will a restart pick up the image after rollout?
      The available documentation does not guarantee that an ordinary restart re-resolves a Flex app onto the newest regional language image. It does document that a site update—a code deployment or configuration change—replaces running instances under the default Recreate strategy.^4^ After Support confirms that 22.23.4 or later is available in East US 2:
      1. Perform a harmless, persistent application-setting update during a maintenance window. This triggers a site update without republishing code.
      2. With the default Recreate strategy, expect all running instances to restart, with possible brief downtime and termination of in-progress executions.
      3. Invoke each independently scaled function or scale group and log both process.version and the instance identifier.
      4. Confirm every newly observed instance reports v22.23.4 or later.
      5. If any new instance still reports v22.23.2, add its instance ID and timestamp to the support case rather than repeatedly publishing.

    A minimal temporary diagnostic is:

    const { app } = require('@azure/functions');

app.http('runtimeVersion', {
  methods: ['GET'],
  authLevel: 'function',
  handler: async () => ({
    jsonBody: {
      node: process.version,
      instance: process.env.WEBSITE_INSTANCE_ID
    }
  })
});

    Remove or restrict this endpoint after verification if exposing runtime metadata is not desired.

    References

    1. Confirm Node.js 22.23.4 rollout for CVE-2026-105482 on Azure Functions ...
    2. Azure Functions Flex Consumption plan hosting | Microsoft Learn
    3. How to target Azure Functions runtime versions (platform-linux)
    4. Site update strategies in Flex Consumption
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.