26.10.22 - Node.js Fixes 10 Vulnerabilities: October Security Release and What to Do
On the same day as PHP, Node.js shipped fixes for 10 vulnerabilities, four rated High. What is affected and what to do.
On October 21, 2026 — the same day as PHP's "php2shell" — Node.js released security updates for its 26.x, 24.x and 22.x lines, fixing 10 vulnerabilities, four of them rated High.
The main issues
- Brotli decoder bug (CVE-2026-111497): an out-of-bounds write when decompressing data that could lead to remote code execution. The most important fix.
- TLS hostname checks (CVE-2026-105483, CVE-2026-106069): a certificate for the wrong host could be accepted.
- DNS (CVE-2026-105482): names with special characters could be truncated and resolve to an unintended name.
- Dependencies such as OpenSSL, c-ares, SQLite and Undici were updated as well.
What to do now
- Update Node.js to a fixed version: 26.12.1, 24.22.1 or 22.23.4.
- End-of-life versions such as Node.js 25 receive no fixes — move to a supported version such as the 24.x LTS.
- Web apps and APIs built on Node.js (Next.js, Nuxt, Express…) and their Docker images are affected too. Check both build and production environments.
About the MetAI website
The MetAI website (met-ai.tech) does not run Node.js on any public server, so it is not affected. It is served as static files on Cloudflare, and its few dynamic features run on Cloudflare's own runtime, not Node.js. Our internal site-building tool is not exposed to the internet, and we have already updated it to the patched Node.js version anyway.
How MetAI can help
Not sure whether your site is affected, or where to start? MetAI can help with:
- Emergency check: we identify which PHP or Node.js versions your websites and apps run, and whether they are affected.
- Fixes and updates: we safely update PHP, Node.js, WordPress, plugins and libraries — and migrate end-of-life environments.
- Protection going forward: attack filters, migration to server-less static sites and monitoring for suspicious traffic, so that similar vulnerabilities in the future are far less likely to hurt you.
We can give you the same setup we use on our own site. Get in touch for a free 30-minute consultation.