Outdated/vulnerable node.js version in latest server version

RStudio IDE
,
1

Hello all,

Does anyone know the plan for updating node.js for the linux/server version?
Our Tenable/Nessus software is flagging it as a high vulnerability (and my security team is yelling at me to patch it!).

For reference (node.js):
Installed version : 22.22.2 (released in March)
Fixed version : 22.23.2
Tenable detail: Node.js 22.x < 22.23.2 / 24.x < 24.18.1 / 26.x < 26.5.1 Multip...<!-- --> | Tenable®

Secondly, and much less important, v22 is in maintenance mode until May `27 and v24 will move to maintenance mode in Nov-ish. Is there a timeline to move to v26 at some point.

Thanks!
Brian

2

Take a look at this reddit thread last week: https://www.reddit.com/r/rstats/comments/1vuj001/shinyserver_still_under_active_developement/

TLDR: The next update will remove the embedded node.js version.

Woops - that is about shiny-server!

3

Hi, it will be updated to 22.23.2 in the upcoming 2026.09 release of RStudio (should be released ~mid Sept).

Tracking issue: Update bundled Node.js to 22.23.2 · Issue #18670 · rstudio/rstudio · GitHub

Will move to 24 in the following release (don't want to make that big of a change at the last minute for Sept): Update bundled Node.js to latest Node 24 LTS · Issue #18671 · rstudio/rstudio · GitHub

We will eventually move to 26, but probably not until a release early next year.

FYI, this bundled node.js is used for two things: Posit Assistant and GitHub Copilot.

You can also override and point at a node.js that you have installed separately:

Overriding the Node.js runtime used by Copilot / Posit Assistant

1. Per-feature R option (highest priority, overrides just one feature)

Set in Rprofile.site (or any startup R code loaded server-wide):

options(rstudio.copilot.nodeBinaryPath = "/path/to/custom/node")   # Copilot only
options(rstudio.positAi.nodeBinaryPath = "/path/to/custom/node")   # Posit Assistant only

Each must point directly at a node executable (not a directory).

2. Admin-configured server-wide path (external-node-path, affects both Copilot and Posit Assistant)

In /etc/rstudio/rsession.conf:

external-node-path=/path/to/custom/node

This can point either to the node binary itself, or to a directory containing bin/node or node — this one setting is shared by both features, since they both call the same resolver.

Caveat: on Apple Silicon Macs, if the resolved directory doesn't have an arm64-specific binary, RStudio auto-substitutes node-arm64 next to it — so if overriding on macOS ARM, make sure that binary is arm64-native.

1 Like