diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9fc7d901d..60148d84a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [ 18, 20, 22, 24 ]
+        node-version: [ '>=22.23.4 <23', '>=24.22.1 <25', '>=26.12.1 <27' ]
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -37,6 +37,7 @@ jobs:
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ matrix.node-version }}
+        check-latest: true
     - name: Update rush shrinkwrap dependencies (for different node versions)
       run: node common/scripts/install-run-rush.js update --full --recheck
     - run: npm install rollup -g
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 563ea506a..7e19d830a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -40,7 +40,7 @@ jobs:
           - language: actions
           - language: javascript
           - language: javascript-typescript
-            node-version: '18'
+            node-version: '>=24.22.1 <25'
         # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
         # Use `c-cpp` to analyze code written in C, C++ or both
         # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
@@ -61,6 +61,7 @@ jobs:
       uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ matrix.node-version }}
+        check-latest: true
         
     # Install dependencies for JavaScript projects
     - name: Install dependencies
diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index d96b1263e..8e3cd4707 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -28,10 +28,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Use Node.js ${{ matrix.node-version }}
+      - name: Use patched Node.js LTS
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: '>=24.22.1 <25'
+          check-latest: true
       - name: Update rush shrinkwrap dependencies (for different node versions)
         run: node common/scripts/install-run-rush.js update --full
       - run: npm install rollup -g
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 000000000..b6f27f135
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+engine-strict=true
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 000000000..ce62013c3
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.22.1
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9661939cc..41de208f0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -26,6 +26,23 @@ This project has adopted the [Microsoft Open Source Code of Conduct](https://ope
 [GitHubIssue]: https://github.com/microsoft/ApplicationInsights-JS/issues
 
 ## Clone and setup
+
+Use a patched Node.js runtime before installing dependencies or running any repository tooling:
+Node.js 22.23.4+, 24.22.1+, or 26.12.1+ within those respective release lines.
+Node.js 24 LTS is recommended; `.nvmrc` selects 24.22.1 for local version managers.
+Node.js 18, 20, and other unsupported release lines must not be used for builds or releases.
+The root npm and Rush configuration enforce these build-time version requirements; they do not change browser SDK compatibility.
+
+These minimum versions fix [CVE-2026-111497](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases).
+Although SDK telemetry compression uses gzip, npm and HTTP clients used by repository tools can decode Brotli responses.
+Updating npm dependencies or disabling telemetry compression does not patch the native decoder.
+Always update Node.js itself before running `npm install`, including on release agents.
+
+CI selects the latest patches satisfying the security minimums instead of reusing an older cached major version.
+GitHub JavaScript actions use the runner's bundled Node.js runtime independently of `actions/setup-node`.
+Keep self-hosted runners and their bundled action runtimes patched, and verify managed runner updates separately.
+Private release pipelines and container images maintained outside this repository must also use patched runtimes.
+
 1. Clone the repository and create a new branch
 2. Install all dependencies
 	```
diff --git a/common/config/rush/pnpm-config.json b/common/config/rush/pnpm-config.json
index 24b9203c3..fc519507b 100644
--- a/common/config/rush/pnpm-config.json
+++ b/common/config/rush/pnpm-config.json
@@ -11,7 +11,7 @@
     "form-data": ">=2.5.6 <3.0.0",
     "js-yaml": ">=4.3.1 <5.0.0",
     "markdown-it": ">=14.2.0",
-    "decode-uri-component": ">=0.5.0",
+    "decode-uri-component": "0.5.0",
     "@microsoft/api-extractor": "7.58.7",
     "basic-ftp": ">=6.2.1",
     "brace-expansion": ">=5.0.12 <6.0.0",
diff --git a/common/config/rush/pnpm-lock.yaml b/common/config/rush/pnpm-lock.yaml
index bd02029ef..c50266506 100644
--- a/common/config/rush/pnpm-lock.yaml
+++ b/common/config/rush/pnpm-lock.yaml
@@ -15,7 +15,7 @@ overrides:
   form-data: '>=2.5.6 <3.0.0'
   js-yaml: '>=4.3.1 <5.0.0'
   markdown-it: '>=14.2.0'
-  decode-uri-component: '>=0.5.0'
+  decode-uri-component: 0.5.0
   '@microsoft/api-extractor': 7.58.7
   basic-ftp: '>=6.2.1'
   brace-expansion: '>=5.0.12 <6.0.0'
diff --git a/package.json b/package.json
index a7410bfc1..15152394d 100644
--- a/package.json
+++ b/package.json
@@ -48,6 +48,9 @@
         "url": "https://github.com/microsoft/ApplicationInsights-JS/issues"
     },
     "homepage": "https://github.com/microsoft/ApplicationInsights-JS#readme",
+    "engines": {
+        "node": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27"
+    },
     "devDependencies": {
         "@microsoft/rush": "5.178.1",
         "@nevware21/grunt-eslint-ts": "^0.5.2",
diff --git a/rush.json b/rush.json
index b7c1287c9..0ce7d4b05 100644
--- a/rush.json
+++ b/rush.json
@@ -2,6 +2,7 @@
   "$schema": "https://developer.microsoft.com/json-schemas/rush/v5/rush.schema.json",
   "pnpmVersion": "10.34.5",
   "rushVersion": "5.178.1",
+  "nodeSupportedVersionRange": ">=22.23.4 <23 || >=24.22.1 <25 || >=26.12.1 <27",
   "projectFolderMaxDepth": 4,
   "projects": [
     {