Security release: Node.js update. If you self-host, pull the new images.
Node.js shipped a security release on 11 Nov 2026 with 16 fixes, 7 of them high severity. Both images now pin the patched Node:
| Image | Before | Now |
|---|---|---|
usesend/usesend
| node:24-alpine3.24 (floating)
| node:24.22.3-alpine3.24
|
usesend/smtp-proxy
| node:22-alpine (floating)
| node:22.23.5-alpine3.24
|
How exposed were you? Probably not very, but upgrade soon:
- App image: the server speaks plain HTTP behind your reverse proxy, so most of this batch (HTTP/2, HTTPS and TLS-server bugs) doesn't reach it. You still get Node's updated HTTP parser (llhttp) and fetch client (undici).
- SMTP image: already on Node 22. The worst bug for SMTP servers, a remote crash of TLS servers (CVE-2026-126051), only affects Node 24 and 26.
Also in this release
- A database migration runs automatically on startup. It adds the waitlist-application table and a
Team.freePlanAllowedcolumn, and marks every existing team as allowed. Plan limits only apply in cloud mode, so self-hosted sending doesn't change. - Plan-limit checks are serialized per team, so parallel requests can't slip past a limit (cloud mode).
What's Changed
- fix(limits): serialize plan-limit checks and creates per team by @KMKoushik in #493
- feat(waitlist): save waitlist applications and require a plan for new teams (cloud only) by @KMKoushik in #494
- fix(build): run Railway and Coolify builds on Node 22.23.5 by @KMKoushik in #501
- fix(build): install Node and pnpm in the setup phase by @KMKoushik in #502
- fix(docker): pin self-host images to Node 24.22.3 and 22.23.5 by @KMKoushik in #503
Full Changelog: v1.10.2...v1.10.3