AZDO.1024: Disable Node 6 tasks.
| ID | AZDO.1024 |
| Severity | Medium |
| Suite | Mito |
| Product | Azure DevOps |
| Feature | Pipelines |
| Security area | Engineering systems |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Framework controls | nist-800-53-r5:SI-2 Flaw Remediation |
| Reads from | Azure DevOps |
| Further reading | https://learn.microsoft.com/azure/devops/release-notes/roadmap/2022/no-node-6-on-hosted-agents |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Disable Node 6 tasks.
Rationale: Node.js 6 reached end-of-life in April 2019 and no longer receives security patches. Pipeline tasks that use the Node 6 execution handler run on an unpatched, unsupported runtime, which may expose the pipeline to known vulnerabilities.
Remediation action
Section titled “Remediation action”Enable the restriction to prevent Node 6 tasks from executing in pipelines.
- Sign in to your organization.
- Choose Organization settings.
- Select Settings under Pipelines.
- Go to the section “Task restrictions” and turn on “Disable Node 6 tasks”
Results: With this enabled, pipelines will fail if they utilize a task with a Node 6 execution handler.
Related links
Section titled “Related links”- Learn - Prevent malicious code execution
- Learn - Remove Node 6 and Node 10 runners from Microsoft-hosted agents
Mito check. Author: SebastianClaesson. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.