7 new Node.js vulnerabilities, 0 things for you to do

On October 21, the Node.js project released security fixes for all supported versions (22, 24 and 26), covering 7 vulnerabilities, four of them rated high severity. We’re installing the patched versions across our hosting platform and will restart your Node.js application once the update reaches your account. You don’t need to do anything.

In short:

• What happened: Node.js fixed 7 security flaws, the most serious in how it unpacks compressed data. Only a patched Node.js fixes them.
• What we know: The most serious flaw can’t be triggered by website visitors and has no known exploit in the wild yet.
• What we’re doing: We’ve added extra protection and are patching our platform as soon as possible, with older versions (20.x and 18.x) following later. Check status.
• What you need to do: Nothing on Hostinger hosting plans. VPS users who run Node.js themselves should update to 22.23.4, 24.22.1 or 26.12.1.

What happened

On October 21, 2026, Node.js released versions 22.23.4, 24.22.1 and 26.12.1, fixing 7 security issues. 

The most serious is CVE-2026-111497, a flaw in how Node.js unpacks Brotli-compressed data. An attacker who could get an application to process specially crafted Brotli data might read its memory or run code with its permissions. It only matters when an application decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server.

The other high-severity fixes address weaknesses in how Node.js checks TLS certificates against IP addresses and validates DNS lookups. The remaining fixes are rated medium or low and cover the HTTP agent, random number generation, and the permission model.

Because these flaws are in Node.js itself, updating your framework or npm packages won’t fix them; you need a patched Node.js.

What we did

Our security team looked closely at CVE-2026-111497. It can’t be triggered by visitors coming to your website, there’s no known exploit in the wild, and we’ve added web application firewall (WAF) hardening rules that block incoming requests with a Brotli-compressed body, which closes the main route an attacker could use to reach this flaw. These rules apply to all Node.js hosting accounts automatically, with no configuration needed.

The WAF covers traffic coming into your site. It doesn’t cover responses your app fetches from other servers. It reduces exposure but doesn’t replace patching, so we’re now installing the patched versions across the platform for every supported major version (22, 24 and 26). Each account keeps its current major version, so only the patch level changes. The patched builds come through our vendor, CloudLinux, and we expect the update to reach all accounts by by 20:00 UTC on 22 October 2026.

After the update reaches your account, we restart your Node.js application so it runs the patched version.

Older versions are covered too. The Node.js project no longer supports 20.x and 18.x, so it won’t release fixes for them, but CloudLinux will patch them as well. This takes more time, and we’ll update this post as soon as those builds are ready.

You can follow live progress on our status page.

What you need to do

If you’re on Hostinger hosting plans, you’re taken care of. We handle the update and the restart. No rebuild or re-upload is needed, and static sites built with Node.js tooling (for example a Next.js export, Astro, or Vite) aren’t affected, because Node.js only runs during the build step.

If you run Node.js yourself on a VPS, update to 22.23.4, 24.22.1 or 26.12.1, depending on your major version, then restart your Node.js processes. If you use containers, rebuild on a patched base image and redeploy. Earlier Node.js versions won’t receive upstream fixes, so on a VPS you’ll need to upgrade to a supported version.

Our goal and vision

We can’t stop vulnerabilities from appearing in the software we run, but you can count on us to tell you quickly if anything threatens your site, in plain language, with clear information about what happened, what we did and whether you need to act.

We’re working with our partners to speed up patch delivery, while improving how we track upstream security releases and expanding our firewall rules for known exploit patterns. Our bug reward program also continues, and anyone who finds a vulnerability on our platform is welcome to report it and earn a reward.

We’ll keep this post and our status page updated until every account is patched, including older Node.js versions.

If you have any questions about your site, reach out to our Customer Success team 24/7 via live chat in the Hostinger dashboard.