Managed Node.js 24.x still reports v24.21.0 after redeploy — CVE-2026-111497 patch status - Help

Hello Vercel team,

Could you clarify the rollout status of the managed Node.js runtime fix for CVE-2026-111497?

A SvelteKit application configured for Node.js 24.x was redeployed on October 23 without build cache. Production runtime logs after redeployment reported:

node=v24.21.0 brotli=1.2.0

Your October 21 security bulletin says patched versions are being rolled out and that Vercel manages patch versions for Node.js 22.x and 24.x.

Does the managed runtime reporting v24.21.0 include a backported fix, or is it still awaiting the patch?
If it is awaiting the patch, when will it become available?
Will existing deployments receive it automatically, or is a new deployment required?

We understand the WAF reduces exposure, but would appreciate confirmation of the runtime patch itself.

Bulletin: https://vercel.com/kb/bulletin/node-js-security-advisory

vercel.com

Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) | Vercel Knowledge Base

Vercel WAF blocks known exploit patterns for CVE-2026-111497, but does not replace patching.

Thank you.