{"id":21415,"date":"2026-10-22T10:19:23","date_gmt":"2026-10-22T10:19:23","guid":{"rendered":"https:\/\/www.hostinger.com\/support\/?p=21415"},"modified":"2026-10-29T15:20:18","modified_gmt":"2026-10-29T15:20:18","slug":"node-js-24-22-1-security-update-on-hostinger-hosting","status":"publish","type":"post","link":"https:\/\/www.hostinger.com\/support\/node-js-24-22-1-security-update-on-hostinger-hosting\/","title":{"rendered":"Node.js 24.22.1 security update on Hostinger hosting"},"content":{"rendered":"

The Node.js 24.22.1 security update is part of the Node.js October 2026 security releases, which patch Node.js 22, 24, and 26 and include four high-severity vulnerabilities. Hostinger installs the update on Hostinger hosting plans for you. Agency Hosting already runs the patched versions, and the update for Web and Cloud hosting is rolling out. If you use a Hostinger AI automation app or run Node.js on a Hostinger VPS, update it yourself.<\/p>

What the Node.js 24.22.1 security update fixes<\/h2>

On October 21, 2026, the Node.js project released Node.js 22.23.4, 24.22.1, and 26.12.1 to fix security vulnerabilities in every supported Node.js version. Four of the vulnerabilities are rated high severity.<\/p>

The most serious vulnerability, CVE-2026-111497, is a flaw in how Node.js unpacks Brotli-compressed data. CVE-2026-111497 only matters when an application decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server. Updating your framework or npm packages doesn’t fix these vulnerabilities, because the flaws are in Node.js itself.<\/p>

Node.js 24.22.1 security update status by Hostinger product<\/h2>

The Node.js 24.22.1 security update is live on Agency Hosting and rolling out on Web hosting and Cloud hosting. The status for each Hostinger product is listed below.<\/p>

\n\n\n\n\n\n\n\n
\n

Hostinger product<\/b><\/p>\n<\/td>\n

\n

Status<\/b><\/p>\n<\/td>\n

\n

What you need to do<\/b><\/p>\n<\/td>\n<\/tr>\n

\n

Agency Hosting.<\/p>\n<\/td>\n

\n

Patched. Node.js only runs while your website builds, so live websites aren’t exposed.<\/p>\n<\/td>\n

\n

Nothing.<\/p>\n<\/td>\n<\/tr>\n

\n

Web and Cloud hosting.<\/p>\n<\/td>\n

\n

Rolling out. Hostinger installs the patched versions and restarts your Node.js application.<\/p>\n<\/td>\n

\n

Nothing.<\/p>\n<\/td>\n<\/tr>\n

\n

Hostinger AI automation apps.<\/p>\n<\/td>\n

\n

An updated app version is available.<\/p>\n<\/td>\n

\n

Update your app from the Hostinger dashboard.<\/p>\n<\/td>\n<\/tr>\n

\n

VPS hosting.<\/p>\n<\/td>\n

\n

You manage Node.js yourself.<\/p>\n<\/td>\n

\n

Update Node.js on your VPS.<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>

Node.js 20 and 18 no longer get fixes from the Node.js project, but Hostinger’s vendor, CloudLinux, will patch them on Hostinger hosting plans later. For details on how Node.js runs on each hosting plan, see Node.js hosting options at Hostinger<\/a>.<\/p>

How Hostinger protects your Node.js application during the update<\/h2>

Hostinger web application firewall (WAF) rules block incoming requests with a Brotli-compressed body on all Node.js hosting accounts automatically, with no configuration needed. CVE-2026-111497 can’t be triggered by visitors coming to your website, and there’s no known exploit in the wild.<\/p>

The Hostinger WAF covers traffic coming into your website, but not responses your Node.js application fetches from other servers. The WAF reduces exposure but doesn’t replace the patched Node.js version.<\/p>

What Hostinger does during the Node.js 24.22.1 security update<\/h2>

Hostinger installs the patched Node.js version on the server and restarts your Node.js application, so you don’t need to take any action on Hostinger hosting plans. The update works in four ways:<\/p>