Important
New Relic scans the synthetics job manager image for vulnerabilities every day and publishes a patched release every Thursday. Each release includes fixes for operating system and application CVEs identified by Tuesday 6:29 PM UTC of that week. If we identify a CVE after that time, the fix ships in the following week's Thursday release.
We publish every release to the latest tag, so private locations that use latest get fixes automatically. If you use a specific version tag, manually update to the newest version to get current fixes.
The job manager releases separately from the Ping, Node API, and Node browser runtimes. Check each runtime's release notes for its own fixes.
Security patches
Library vulnerabilities:
- Upgraded guava to 33.7.2-jre: CVE-2026-102554
OS vulnerabilities:
- Updated zlib1g to 1:1.3.dfsg-3.1ubuntu2.3: CVE-2026-85091
- Updated libbrotli1: CVE-2026-111497
CA certificates:
- Addressed the eMudhra certificate authority compromise by removing trust for the eMudhra (emSign) root certificates and the Comodo AAA Certificate Services root from the OS CA bundle and the respective keystores
Security patches
OS vulnerabilities:
- CVE-2026-86409
- CVE-2026-86414
- CVE-2026-87862
- CVE-2026-87863
- CVE-2026-87864
- CVE-2026-92388
- CVE-2026-92389
- CVE-2026-92391
- CVE-2026-94266
Enhancement
- Fixed an issue where the Synthetics Job Manager would crash on startup when custom modules were enabled in a Podman private location.
Security patches
OS vulnerabilities:
- CVE-2026-35189
- CVE-2026-54872
- CVE-2026-75805
- CVE-2026-75806
- CVE-2026-77696
- CVE-2026-84782
Security patches
OS vulnerabilities:
- CVE-2026-13608
- CVE-2026-18924
- CVE-2026-80230
- CVE-2026-82209
Security patches
OS vulnerabilities:
- CVE-2026-15534
- CVE-2026-19487
- CVE-2026-39113
Library vulnerabilities:
- CVE-2026-12611
- CVE-2026-19203
- CVE-2026-62380
- CVE-2026-89407
- CVE-2026-89425
- CVE-2026-91776
- CVE-2026-91777
Enhancement
- Support for Kerberos authentication and run Scripted Browser monitors from Private Locations, enabling secure authentication and browser-based monitoring for applications hosted within private network.
Security patches
OS vulnerabilities:
- CVE-2026-19499
- CVE-2026-19542
- CVE-2026-6368
- CVE-2026-6791
- CVE-2026-77117
- CVE-2026-80489
Library vulnerabilities:
- CVE-2026-75595
- CVE-2026-75596
Security patches
OS vulnerabilities:
- CVE-2026-57062
Security patches
Fixed the following vulnerabilities:
- CVE-2024-2236
- CVE-2025-5278
- CVE-2025-6141
- CVE-2025-15649
- CVE-2026-7017
- CVE-2026-9538
- CVE-2026-7017
- CVE-2026-9538
- CVE-2026-12087
- CVE-2026-13221
- CVE-2026-13595
- CVE-2026-13757
- CVE-2026-18938
- CVE-2026-27171
- CVE-2026-27456
- CVE-2026-42250
- CVE-2026-48959
- CVE-2026-48962
- CVE-2026-53612
- CVE-2026-53613
- CVE-2026-53614
- CVE-2026-53615
- CVE-2026-53910
- CVE-2026-54371
- CVE-2026-57432
- CVE-2026-57433
- CVE-2026-59843
- CVE-2026-59845
- CVE-2026-59846
- CVE-2026-59847
- CVE-2026-59848
- CVE-2026-59850
Fixes
- Fixed Private Location metrics not reporting correctly for SJM on container crashes.
Security patches
Fixed the following vulnerabilities:
OS vulnerabilities:
- CVE-2026-11856
- CVE-2026-8932
Library vulnerabilities:
- CVE-2026-54399
- CVE-2026-54428
- CVE-2026-64607