Node.js 24

Apply JavaScript ES2026 first. These rules cover Node.js 24 LTS.

Runtime and permissions

• Run the newest Node.js 24 release; redeploy every security release. Rebuild line-following images (e.g. node:24-slim) with docker build --pull or bot-updated digests. Verify exact Dockerfile/CI versions on nodejs.org or use build-failing placeholders.
• Check runtime security with locked-dev-dependency is-my-node-vulnerable, never bare npx; npm audit misses Node.js.
• Check process.versions.undici against published Undici advisories separately from any npm-installed undici; updating the package does not replace the runtime's bundled fetch, WebSocket or EventSource implementation. Check the actual deployed artifact, including releases not labeled as security releases. Match each advisory to the component that implements it: built-in Fetch/WebSocket/EventSource code remains bundled when a custom dispatcher supplies transport, while dispatcher and interceptor conditions apply to the package supplying those components.
• Start with --permission; grant only required --allow-fs-read, --allow-fs-write, --allow-worker, --allow-child-process, --allow-addons, --allow-wasi, --allow-inspector capabilities/exact paths. Restrict egress externally: Node 24 has no network permissions. On 24.20.0+, revoke startup-only grants with process.permission.drop() once used; it neither closes open descriptors, children or workers nor narrows wildcard or directory grants to sub-paths.
• Permissions are defense in depth for trusted code: relative symlinks escape grants;