Security Update: Node.js Patched Across Our Network
Following this week's PHP security updates, the Node.js project also released fixes for several vulnerabilities on October 21, 2026, including CVE-2026-111497, a flaw in the Brotli decoder that could allow remote code execution.
What we did
As part of our ongoing security maintenance, we have updated Node.js to the patched versions across our infrastructure. All affected versions (Node.js 18, 20, 22, and 24) now include the official fixes, and applications have been restarted to apply them.
Do you need to do anything?
No action is required. If you run Node.js applications on your hosting, they are now protected automatically.
A quick note on version numbers
For some Node.js versions, security fixes are applied as backports, so the version number may stay the same while the fix is included. Your applications are protected regardless of the displayed version number.
Stay updated with us
For real-time updates on security and service announcements, follow us:
