Confirm Node.js 22.23.4 rollout for CVE-2026-105482 on Azure Functions Flex Consumption

Hi Thanh Cong Nguyen & thx for join me at Q&A platform,

I haven't found an official Microsoft announcement confirming that Node.js 22.23.4 (or a later patched 22.x build) has been deployed across Azure Functions Flex Consumption as of October 22.

One important distinction here is that Node.js patch updates on Flex Consumption are managed by the Azure Functions platform. Selecting Node.js 22 configures the major runtime version, but it doesn't let u select a specific patch release such as 22.23.4.

The easiest way to verify what ur Function App is actually running is to log the Node.js version from inside the function:

console.log("Node.js runtime:", process.version);

console.log("Node.js details:", process.versions);

console.log("Instance ID:", process.env.WEBSITE_INSTANCE_ID);

Check the output in Application Insights or ur function logs. This reports the runtime executing ur code, rather than the Node.js version installed on ur development machine or build agent.

Keep in mind that Flex Consumption scales across multiple instances, and platform updates can roll out gradually. Seeing v22.23.4 on one instance wouldn't necessarily confirm that every instance in every region has received the update.

I'd also avoid assuming that an earlier version string automatically proves the CVE is exploitable. Microsoft may apply platform-specific mitigations or backported fixes, but that needs explicit confirmation from the Azure Functions engineering team.

For a security or compliance requirement, I'd open an Azure Functions support case and request confirmation of the patched Node.js runtime rollout for ur specific region and subscription. Ask whether CVE-2026-105482 is remediated in the currently deployed Flex Consumption runtime, whether the fix is still rolling out, and whether any customer action is required.

I'd include the Function App resource ID, region, configured Node.js major version, and the process.version output.

The key point is that Node.js 22 being supported on Flex Consumption doesn't, by itself, confirm deployment of security patch 22.23.4. Only runtime verification and an official Microsoft confirmation can establish that.

Could u share which Azure region ur Function App is running in and what process.version currently returns? That would help determine whether the patched runtime has reached ur environment.

rgds,

Alex

p.s. if my answer is help - pls mark it as an answer