Node.js Security Vulnerability: What Developers Need to Know

Node.js Security Vulnerability: What Developers Need to Know

What Happened?

On October 21, 2026, the Node.js project released security updates for versions 22, 24, and 26, addressing seven security vulnerabilities.

The most serious, CVE-2026-111497, affects how Node.js processes Brotli-compressed data. Under specific conditions, specially crafted data could potentially expose application memory or allow code execution with the application's permissions.

Other fixes address TLS certificate verification, DNS lookups, and additional security weaknesses.

According to Hostinger's advisory, the main vulnerability has no known exploit in the wild, and ordinary website visitors cannot trigger it directly.

Who Is Affected?

The patched releases are:

• Node.js 22: 22.23.4

• Node.js 24: 24.22.1

• Node.js 26: 26.12.1

Older versions, including Node.js 20 and 18, require separate attention because they are no longer supported upstream.

How to Fix the Vulnerability

If you use Hostinger shared hosting: Hostinger is handling the security updates and application restarts. No manual action is required according to its advisory.

If you manage your own VPS: Upgrade Node.js to the appropriate patched release, restart your application processes, and verify the running version using:

node -v

For containerized applications, rebuild using a patched base image and redeploy.

Important: Updating npm packages or your web framework alone will not fix vulnerabilities in the Node.js runtime itself.

Conclusion

This incident highlights the importance of monitoring security advisories and promptly patching server-side software. Developers managing production applications should keep Node.js supported, apply security updates, and verify that deployed services are running patched versions.

References:

• Node.js Security Release

• Hostinger Security Incident Status