Self-hosting the mempool explorer? Its backend image still bundles Node 24.13.0, from before the Oct 20 Node security release

Node.js put out security releases on October 20 (24.22.1 for the 24.x line): https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

The published mempool backend images (mempool/backend v3.3.1 and latest, both from April) still bundle Node 24.13.0. There’s a PR upstream to bump it, but it’s waiting on the maintainers, and no rebuilt image is out yet.

To check yours:

docker exec node -v

If your node platform packages the mempool app for you, it may already ship its own build, so check before changing anything.

If it says v24.13.0 and you build your own stack, this is what we’re running until upstream ships a fix:

 FROM node:24.22.1-bookworm-slim AS node FROM mempool/backend:v3.3.1 COPY --from=node /usr/local/bin/node /usr/bin/node 

Same Debian 12 base and the same native-module ABI, so the backend’s Rust addon loads fine. Build it, point your compose file at the new image, and restart only the backend. It’s been running normally on our instance since the 21st.