Thursday October 22, 2026
Gediminas G.
On October 21, the Node.js project released safety fixes for all supported versions (22, 24 and 26), covering 7 vulnerabilities, four of them rated elevated severity. We’re installing the patched versions throughout our hosting phase and volition restart your Node.js use formerly the update reaches your account. You don’t need to do anything.
In short:
- What happened: Node.js fixed 7 safety flaws, the most grave in how it unpacks compressed data. Only a patched Node.js fixes them.
- What we know: The most grave flaw can’t be triggered by website visitors and has no known utilize in the untamed yet.
- What we’re doing: We’ve added additional safety and are patching our phase as shortly as possible, alongside older versions (20.x and 18.x) following later. Check status.
- What you need to do: Nothing on Hostinger hosting plans. VPS users who run Node.js themselves should update to 22.23.4, 24.22.1 or 26.12.1.
What happened
On October 21, 2026, Node.js released versions 22.23.4, 24.22.1 and 26.12.1, fixing 7 safety issues.
The most grave is CVE-2026-111497, a flaw in how Node.js unpacks Brotli-compressed data. An attacker who could get an use to procedure specially crafted Brotli data power peruse its recollection or run code alongside its permissions. It lone matters whenever an use decompresses Brotli data an attacker controls, specified as a petition build or a reply fetched from another server.
The another high-severity fixes location weaknesses in how Node.js checks TLS certificates against IP addresses and validates DNS lookups. The remaining fixes are rated average or low and shield the HTTP agent, random figure generation, and the approval model.
Because these flaws are in Node.js itself, updating your example or npm packages won’t fix them; you need a patched Node.js.
What we did
Our safety squad looked closely at CVE-2026-111497. It can’t be triggered by visitors coming to your website, there’s no known utilize in the wild, and we’ve added web use firewall (WAF) hardening rules that obstacle incoming requests alongside a Brotli-compressed body, which closes the chief path an attacker could use to attain this flaw. These rules use to all Node.js hosting accounts automatically, alongside no configuration needed.
The WAF covers traffic coming into your site. It doesn’t shield responses your app fetches from another servers. It reduces visibility but doesn’t substitute patching, so we’re now installing the patched versions throughout the phase for all supported important type (22, 24 and 26). Each document keeps its current important version, so lone the place flat changes. The patched builds arrive through our vendor, CloudLinux, and we anticipate the update to attain all accounts by by 20:00 UTC on 22 October 2026.
After the update reaches your account, we restart your Node.js use so it runs the patched version.
Older versions are covered too. The Node.js project no longer supports 20.x and 18.x, so it won’t publish fixes for them, but CloudLinux volition place them as well. This takes additional time, and we’ll update this article as shortly as those builds are ready.
You can prosecute live advancement on our status page.
What you need to do
If you’re on Hostinger hosting plans, you’re taken attention of. We grip the update and the restart. No rebuild or re-upload is needed, and fixed sites built alongside Node.js tooling (for example a Next.js export, Astro, or Vite) aren’t affected, since Node.js lone runs during the build step.
If you run Node.js yourself on a VPS, update to 22.23.4, 24.22.1 or 26.12.1, depending on your important version, afterward restart your Node.js processes. If you use containers, rebuild on a patched basis depiction and redeploy. Earlier Node.js versions won’t obtain upstream fixes, so on a VPS you’ll need to upgrade to a supported version.
Our goal and vision
We can’t halt vulnerabilities from appearing in the application we run, but you can figure on us to inform you quickly if item threatens your site, in plain language, alongside apparent data concerning what happened, what we did and whether you need to act.
We’re operating alongside our partners to speed up place delivery, during improving how we track upstream safety releases and expanding our firewall rules for known utilize patterns. Our bug reward program additionally continues, and anyone who finds a exposure on our phase is greeted to study it and acquire a reward.
We’ll keep this article and our position leaf updated until all document is patched, including older Node.js versions.
If you have any questions concerning your site, attain out to our Customer Success squad 24/7 via live conversation in the Hostinger dashboard.
Gediminas is a communications expert passionate concerning technologies and their possibilities. His chief duty is to assistance group comprehend Hostinger products and their features. He likes spending his liberated period bathing in the hot tub, grilling, playing poker, fishing, and another activities.
