Fixed versions

CloudLinux and cPanel package status

This follows the CloudLinux status page on 22 October 2026 at 17:46 UTC. Check the status page before you rely on it, because it changes as packages are released.

Option 1: the one-command helper

The helper script detects CloudLinux and cPanel, lists the Node.js packages on the server, and updates the alt-nodejs, ea-nodejs and nodejs packages it finds. It does not restart your applications. It prints the restart commands at the end.

1. Save the script below as nodejs-fix-all.sh on the server, for example in /root.
2. Check what is installed. This changes nothing:

sudo bash nodejs-fix-all.sh check

3. Update Node.js. The script asks you to type YES before it changes anything:

sudo bash nodejs-fix-all.sh update

4. Restart your Node.js applications (see the restart section below).

The helper script

Read the script before you run it. It does not download anything.

#!/usr/bin/env bash
# nodejs-fix-all.sh
# Checks and updates Node.js for the October 2026 Node.js security releases
# (CVE-2026-111497 and 9 other CVEs). Fixed releases: Node.js 22.23.4, 24.22.1, 26.12.1.
#
# Usage (run as root, after you have a backup or snapshot):
#   sudo bash nodejs-fix-all.sh check     report what is installed. Changes nothing. Default.
#   sudo bash nodejs-fix-all.sh update    update Node.js packages. Asks for confirmation.
#
# The script updates CloudLinux alt-nodejs, cPanel ea-nodejs and the operating system's nodejs package.
# It does not restart your applications. It prints the restart commands at the end.

set -u

MODE="${1:-check}"
FIXED="22.23.4 24.22.1 26.12.1"

say()  { printf '%s\n' "$*"; }
have() { command -v "$1" >/dev/null 2>&1; }

if [ "$(id -u)" -ne 0 ]; then
  say "Run this script as root (sudo bash nodejs-fix-all.sh $MODE)."
  exit 1
fi

if have dnf; then PM="dnf"
elif have yum; then PM="yum"
elif have apt-get; then PM="apt"
else say "No supported package manager found (dnf, yum or apt-get)."; exit 1
fi

CL="no"
if [ -f /etc/cloudlinux-release ] || rpm -q cloudlinux-release >/dev/null 2>&1; then CL="yes"; fi
CPANEL="no"
[ -d /usr/local/cpanel ] && CPANEL="yes"

say "== Detected =="
say "Package manager: $PM"
say "CloudLinux: $CL"
say "cPanel: $CPANEL"

say ""
say "== Installed Node.js =="
if have node; then say "node on PATH: $(node -v)"; else say "No node command on PATH."; fi
if [ "$PM" = "apt" ]; then
  dpkg -l 'nodejs*' 2>/dev/null | awk '/^ii/ {print $2, $3}'
else
  rpm -qa 'nodejs' 'alt-nodejs*-nodejs' 'ea-nodejs*' 2>/dev/null | sort
fi
if [ -d "${NVM_DIR:-$HOME/.nvm}" ]; then
  say "nvm is installed for this user. Update nvm versions with: nvm install 22.23.4 (or 24.22.1, 26.12.1)"
fi

say ""
say "== Fixed releases =="
say "Node.js $FIXED"
say "CloudLinux alt-nodejs 12 to 20 carry backported fixes with lower version numbers. Check their changelog:"
say "  rpm -q --changelog alt-nodejs20-nodejs | grep -E 'CVE-2026-'"

if [ "$MODE" = "check" ]; then
  say ""
  say "Check only. Nothing was changed. Run 'sudo bash nodejs-fix-all.sh update' to update."
  exit 0
fi

if [ "$MODE" != "update" ]; then
  say "Unknown mode: $MODE. Use 'check' or 'update'."
  exit 1
fi

say ""
say "== Update =="
say "This updates Node.js packages. Take a backup or snapshot first."
printf 'Type YES to continue: '
read -r ANSWER
[ "$ANSWER" = "YES" ] || { say "Cancelled. Nothing was changed."; exit 1; }

if [ "$PM" = "apt" ]; then
  say "Updating nodejs (apt)..."
  apt-get update && apt-get -y install --only-upgrade nodejs || say "Warning: apt returned an error. Check the output above."
else
  $PM clean all >/dev/null 2>&1
  if [ "$CL" = "yes" ]; then
    say "Updating CloudLinux alt-nodejs packages..."
    $PM -y upgrade 'alt-nodejs*' || say "Warning: alt-nodejs update returned an error. Check the output above."
  fi
  if [ "$CPANEL" = "yes" ]; then
    say "Updating cPanel ea-nodejs packages..."
    $PM -y upgrade 'ea-nodejs*' || say "Warning: ea-nodejs update returned an error. Check the output above."
  fi
  if rpm -q nodejs >/dev/null 2>&1; then
    say "Updating the operating system's nodejs package..."
    $PM -y upgrade nodejs || say "Warning: nodejs update returned an error. Check the output above."
  fi
fi

say ""
say "== Result =="
if have node; then say "node on PATH: $(node -v)"; fi
if [ "$PM" != "apt" ]; then rpm -qa 'nodejs' 'alt-nodejs*-nodejs' 'ea-nodejs*' 2>/dev/null | sort; fi
say ""
say "Now restart your Node.js applications so they run the updated version:"
say "  PM2:          pm2 restart all"
say "  systemd:      systemctl restart <your-app-service>"
say "  cPanel apps:  Setup Node.js App > Restart, for each application"
say "Compare the versions above with the fixed releases: Node.js $FIXED."

Option 2: update by hand

CloudLinux OS 8 and 9 (alt-nodejs)

dnf clean all && dnf upgrade 'alt-nodejs*'

CloudLinux OS 7 (alt-nodejs)

yum clean all && yum update 'alt-nodejs*'

cPanel servers on CloudLinux OS 8 (ea-nodejs22)

dnf upgrade ea-nodejs22

AlmaLinux, Rocky Linux and RHEL (the operating system’s nodejs)

sudo dnf upgrade nodejs

If no update is available yet, the fix has not reached your distribution. Check again later.

Debian and Ubuntu

sudo apt update && sudo apt install --only-upgrade nodejs

If you installed Node.js from NodeSource, this command also updates it once NodeSource publishes the fixed release.

nvm

nvm install 22.23.4      # or 24.22.1, or 26.12.1, for your line
nvm alias default 22.23.4
node -v

Docker and other containers

Pull the fixed Node.js base image, rebuild your image, and redeploy. A running container keeps the old Node.js until you replace it.

docker pull node:22.23.4
docker build -t your-app .
docker compose up -d   # or your deployment command

Restart your applications

Updating the package does not change applications that are already running. Restart each one.

pm2 restart all                         # PM2
systemctl restart your-app.service      # systemd service

On cPanel with CloudLinux, open Setup Node.js App and restart each application.

Verify the fix

For alt-nodejs 22, 24 and 26, check the version. It should be 22.23.4, 24.22.1 or 26.12.1 or later:

rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs

For alt-nodejs 12, 14, 16, 18 and 20, the fix is a backport, so the version number stays lower. Check the changelog for the CVE IDs:

rpm -q --changelog alt-nodejs20-nodejs | grep -E 'CVE-2026-'

For any other installation, check the running version:

node -v

End-of-life Node.js

The Node.js project says end-of-life versions are always affected when a security release occurs. CloudLinux has backported fixes for some older alt-nodejs versions, but not for alt-nodejs10 or alt-nodejs19. Move applications on those versions to a supported line.

Related: the PHP security update

This is a separate issue from the PHP flaws CVE-2026-109618 and CVE-2026-109619. For those, see our PHP critical security update guide.

Sources

• CloudLinux status page: Node.js security releases, October 2026

Need help with an update? Open a ticket through @CustomerPanel.