I have a project that uses Node.js. Recently, some security flaws were identified in Node. Fixes were released around 10/21/26, and the fixes were applied in Node versions 22.23.4 or later, 24.22.1 or later, or 26.12.1 or later. Because of this I have version requirements in my "package.json" to specify these versions.

Railway documentation states that it will automatically pull in LTS versions of Node. On the nodejs.org website, the current LTS version is 26.13.0 (which is greater than 26.12.1, so this version does include the security fixes). I was expecting my project to be deployed with either 26.12.1 (specified explicitly in my package.json as ">=26.12.1"), or with 26.13.0 which would also be fine.

However, the Railway deployment used 26.12.0, which does NOT have the security fixes, and it violates the engines.node version specification in my package.json. Why did it do that?

Subsequently I tried changing package.json to explicitly require 26.13.0, but again, Railway deployed 26.12.0, which is wrong.

What happened, and why? And how do I fix the deployment to make it give me the latest Node version containing the security fixes?