{"id":5937,"date":"2026-10-22T15:52:38","date_gmt":"2026-10-22T19:52:38","guid":{"rendered":"https:\/\/underhost.com\/blog\/?p=5937"},"modified":"2026-10-23T09:46:19","modified_gmt":"2026-10-23T13:46:19","slug":"nodejs-security-update-october-2026-cve-2026-111497","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/nodejs-security-update-october-2026-cve-2026-111497\/","title":{"rendered":"Node.js Security Update (October 2026): CVE-2026-111497"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Linux<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">Node.js Security Update (October 2026): CVE-2026-111497<\/h1>\n<\/div>\n<div style=\"background:#FFF7ED;border:1px solid #FDBA74;border-radius:16px;padding:20px 22px;margin:24px 0;\">\n<h3 style=\"margin:0 0 10px;color:#9A3412;font-size:20px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#F97316;\"><\/i> Updated 22 October 2026, 17:46 UTC.<\/h3>\n<p style=\"margin:0;color:#7C2D12;line-height:1.7;\">Fixed CloudLinux alt-nodejs and cPanel ea-nodejs22 packages are in the stable repositories. Update your servers and restart your Node.js applications.<\/p>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> On 21 October 2026, the Node.js project released security updates for its 22.x, 24.x and 26.x lines: <strong>Node.js 22.23.4, 24.22.1 and 26.12.1<\/strong>. They fix 10 vulnerabilities, and the highest severity is High. The most serious, <strong>CVE-2026-111497<\/strong>, is an out-of-bounds write in the Brotli decoder that can allow remote code execution. Update Node.js, then restart every Node.js application so it runs the new version.<\/div>\n<nav class=\"uh-toc\" aria-label=\"Table of contents\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#fixed-versions\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Fixed versions<\/a><\/li>\n<li><a href=\"#cloudlinux-and-cpanel-package-status\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">CloudLinux and cPanel package status<\/a><\/li>\n<li><a href=\"#option-1-the-one-command-helper\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 1: the one-command helper<\/a><\/li>\n<li><a href=\"#option-2-update-by-hand\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 2: update by hand<\/a><\/li>\n<li><a href=\"#restart-your-applications\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Restart your applications<\/a><\/li>\n<li><a href=\"#verify-the-fix\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Verify the fix<\/a><\/li>\n<li><a href=\"#end-of-life-node-js\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">End-of-life Node.js<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"fixed-versions\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Fixed versions<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;\">\n<thead>\n<tr style=\"background: #0D1F3C; color: #fff;\">\n<th style=\"padding:14px;text-align:left;\">Node.js line<\/th>\n<th style=\"padding:14px;text-align:left;\">Fixed release<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">22.x<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">22.23.4<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">24.x<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">24.22.1<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">26.x<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">26.12.1<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Older lines (end of life)<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">No upstream fix. CloudLinux ships backported fixes for some versions (see below).<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"cloudlinux-and-cpanel-package-status\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> CloudLinux and cPanel package status<\/h2>\n<p>This follows the CloudLinux status page on 22 October 2026 at 17:46 UTC. Check the status page before you rely on it, because it changes as packages are released.<\/p>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;\">\n<thead>\n<tr style=\"background: #0D1F3C; color: #fff;\">\n<th style=\"padding:14px;text-align:left;\">Package<\/th>\n<th style=\"padding:14px;text-align:left;\">Status<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">alt-nodejs 12, 14, 16, 18, 20, 22, 24 and 26<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Fixed and in stable on CloudLinux OS 8 and 9<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">alt-nodejs 12, 14, 16, 18 and 20<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Fixed and in stable on CloudLinux OS 7. alt-nodejs22 for CloudLinux OS 7 is reaching the repositories.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">alt-nodejs24<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Fixed and in stable on CloudLinux OS 10<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">ea-nodejs22 (cPanel EasyApache 4)<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">ea-nodejs22-22.23.4-1.el8.cloudlinux, in stable on CloudLinux OS 8<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">alt-nodejs10 and alt-nodejs19<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">No fixed build released<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">The operating system&#8217;s own nodejs package<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Arrives through regular RHEL and AlmaLinux updates<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 id=\"option-1-the-one-command-helper\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 1: the one-command helper<\/h2>\n<p>The helper script detects CloudLinux and cPanel, lists the Node.js packages on the server, and updates the alt-nodejs, ea-nodejs and nodejs packages it finds. It does not restart your applications. It prints the restart commands at the end.<\/p>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Save the script below as <code>nodejs-fix-all.sh<\/code> on the server, for example in <code>\/root<\/code>.<\/li>\n<li style=\"margin:0 0 8px;\">Check what is installed. This changes nothing:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash nodejs-fix-all.sh check<\/code><\/pre>\n<ol start=\"3\" style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Update Node.js. The script asks you to type YES before it changes anything:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash nodejs-fix-all.sh update<\/code><\/pre>\n<ol start=\"4\" style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Restart your Node.js applications (see the restart section below).<\/li>\n<\/ol>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">The helper script<\/h3>\n<p>Read the script before you run it. It does not download anything.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>#!\/usr\/bin\/env bash\r\n# nodejs-fix-all.sh\r\n# Checks and updates Node.js for the October 2026 Node.js security releases\r\n# (CVE-2026-111497 and 9 other CVEs). Fixed releases: Node.js 22.23.4, 24.22.1, 26.12.1.\r\n#\r\n# Usage (run as root, after you have a backup or snapshot):\r\n#   sudo bash nodejs-fix-all.sh check     report what is installed. Changes nothing. Default.\r\n#   sudo bash nodejs-fix-all.sh update    update Node.js packages. Asks for confirmation.\r\n#\r\n# The script updates CloudLinux alt-nodejs, cPanel ea-nodejs and the operating system's nodejs package.\r\n# It does not restart your applications. It prints the restart commands at the end.\r\n\r\nset -u\r\n\r\nMODE=\"${1:-check}\"\r\nFIXED=\"22.23.4 24.22.1 26.12.1\"\r\n\r\nsay()  { printf '%s\\n' \"$*\"; }\r\nhave() { command -v \"$1\" &gt;\/dev\/null 2&gt;&amp;1; }\r\n\r\nif [ \"$(id -u)\" -ne 0 ]; then\r\n  say \"Run this script as root (sudo bash nodejs-fix-all.sh $MODE).\"\r\n  exit 1\r\nfi\r\n\r\nif have dnf; then PM=\"dnf\"\r\nelif have yum; then PM=\"yum\"\r\nelif have apt-get; then PM=\"apt\"\r\nelse say \"No supported package manager found (dnf, yum or apt-get).\"; exit 1\r\nfi\r\n\r\nCL=\"no\"\r\nif [ -f \/etc\/cloudlinux-release ] || rpm -q cloudlinux-release &gt;\/dev\/null 2&gt;&amp;1; then CL=\"yes\"; fi\r\nCPANEL=\"no\"\r\n[ -d \/usr\/local\/cpanel ] &amp;&amp; CPANEL=\"yes\"\r\n\r\nsay \"== Detected ==\"\r\nsay \"Package manager: $PM\"\r\nsay \"CloudLinux: $CL\"\r\nsay \"cPanel: $CPANEL\"\r\n\r\nsay \"\"\r\nsay \"== Installed Node.js ==\"\r\nif have node; then say \"node on PATH: $(node -v)\"; else say \"No node command on PATH.\"; fi\r\nif [ \"$PM\" = \"apt\" ]; then\r\n  dpkg -l 'nodejs*' 2&gt;\/dev\/null | awk '\/^ii\/ {print $2, $3}'\r\nelse\r\n  rpm -qa 'nodejs' 'alt-nodejs*-nodejs' 'ea-nodejs*' 2&gt;\/dev\/null | sort\r\nfi\r\nif [ -d \"${NVM_DIR:-$HOME\/.nvm}\" ]; then\r\n  say \"nvm is installed for this user. Update nvm versions with: nvm install 22.23.4 (or 24.22.1, 26.12.1)\"\r\nfi\r\n\r\nsay \"\"\r\nsay \"== Fixed releases ==\"\r\nsay \"Node.js $FIXED\"\r\nsay \"CloudLinux alt-nodejs 12 to 20 carry backported fixes with lower version numbers. Check their changelog:\"\r\nsay \"  rpm -q --changelog alt-nodejs20-nodejs | grep -E 'CVE-2026-'\"\r\n\r\nif [ \"$MODE\" = \"check\" ]; then\r\n  say \"\"\r\n  say \"Check only. Nothing was changed. Run 'sudo bash nodejs-fix-all.sh update' to update.\"\r\n  exit 0\r\nfi\r\n\r\nif [ \"$MODE\" != \"update\" ]; then\r\n  say \"Unknown mode: $MODE. Use 'check' or 'update'.\"\r\n  exit 1\r\nfi\r\n\r\nsay \"\"\r\nsay \"== Update ==\"\r\nsay \"This updates Node.js packages. Take a backup or snapshot first.\"\r\nprintf 'Type YES to continue: '\r\nread -r ANSWER\r\n[ \"$ANSWER\" = \"YES\" ] || { say \"Cancelled. Nothing was changed.\"; exit 1; }\r\n\r\nif [ \"$PM\" = \"apt\" ]; then\r\n  say \"Updating nodejs (apt)...\"\r\n  apt-get update &amp;&amp; apt-get -y install --only-upgrade nodejs || say \"Warning: apt returned an error. Check the output above.\"\r\nelse\r\n  $PM clean all &gt;\/dev\/null 2&gt;&amp;1\r\n  if [ \"$CL\" = \"yes\" ]; then\r\n    say \"Updating CloudLinux alt-nodejs packages...\"\r\n    $PM -y upgrade 'alt-nodejs*' || say \"Warning: alt-nodejs update returned an error. Check the output above.\"\r\n  fi\r\n  if [ \"$CPANEL\" = \"yes\" ]; then\r\n    say \"Updating cPanel ea-nodejs packages...\"\r\n    $PM -y upgrade 'ea-nodejs*' || say \"Warning: ea-nodejs update returned an error. Check the output above.\"\r\n  fi\r\n  if rpm -q nodejs &gt;\/dev\/null 2&gt;&amp;1; then\r\n    say \"Updating the operating system's nodejs package...\"\r\n    $PM -y upgrade nodejs || say \"Warning: nodejs update returned an error. Check the output above.\"\r\n  fi\r\nfi\r\n\r\nsay \"\"\r\nsay \"== Result ==\"\r\nif have node; then say \"node on PATH: $(node -v)\"; fi\r\nif [ \"$PM\" != \"apt\" ]; then rpm -qa 'nodejs' 'alt-nodejs*-nodejs' 'ea-nodejs*' 2&gt;\/dev\/null | sort; fi\r\nsay \"\"\r\nsay \"Now restart your Node.js applications so they run the updated version:\"\r\nsay \"  PM2:          pm2 restart all\"\r\nsay \"  systemd:      systemctl restart &lt;your-app-service&gt;\"\r\nsay \"  cPanel apps:  Setup Node.js App &gt; Restart, for each application\"\r\nsay \"Compare the versions above with the fixed releases: Node.js $FIXED.\"\r\n<\/code><\/pre>\n<h2 id=\"option-2-update-by-hand\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 2: update by hand<\/h2>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">CloudLinux OS 8 and 9 (alt-nodejs)<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>dnf clean all &amp;&amp; dnf upgrade 'alt-nodejs*'<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">CloudLinux OS 7 (alt-nodejs)<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>yum clean all &amp;&amp; yum update 'alt-nodejs*'<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">cPanel servers on CloudLinux OS 8 (ea-nodejs22)<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>dnf upgrade ea-nodejs22<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">AlmaLinux, Rocky Linux and RHEL (the operating system&#8217;s nodejs)<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo dnf upgrade nodejs<\/code><\/pre>\n<p>If no update is available yet, the fix has not reached your distribution. Check again later.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Debian and Ubuntu<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo apt update &amp;&amp; sudo apt install --only-upgrade nodejs<\/code><\/pre>\n<p>If you installed Node.js from NodeSource, this command also updates it once NodeSource publishes the fixed release.<\/p>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">nvm<\/h3>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>nvm install 22.23.4      # or 24.22.1, or 26.12.1, for your line\r\nnvm alias default 22.23.4\r\nnode -v<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">Docker and other containers<\/h3>\n<p>Pull the fixed Node.js base image, rebuild your image, and redeploy. A running container keeps the old Node.js until you replace it.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>docker pull node:22.23.4\r\ndocker build -t your-app .\r\ndocker compose up -d   # or your deployment command<\/code><\/pre>\n<h2 id=\"restart-your-applications\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Restart your applications<\/h2>\n<p>Updating the package does not change applications that are already running. Restart each one.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>pm2 restart all                         # PM2\r\nsystemctl restart your-app.service      # systemd service<\/code><\/pre>\n<p>On cPanel with CloudLinux, open <strong>Setup Node.js App<\/strong> and restart each application.<\/p>\n<h2 id=\"verify-the-fix\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Verify the fix<\/h2>\n<p>For alt-nodejs 22, 24 and 26, check the version. It should be 22.23.4, 24.22.1 or 26.12.1 or later:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs<\/code><\/pre>\n<p>For alt-nodejs 12, 14, 16, 18 and 20, the fix is a backport, so the version number stays lower. Check the changelog for the CVE IDs:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>rpm -q --changelog alt-nodejs20-nodejs | grep -E 'CVE-2026-'<\/code><\/pre>\n<p>For any other installation, check the running version:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>node -v<\/code><\/pre>\n<h2 id=\"end-of-life-node-js\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> End-of-life Node.js<\/h2>\n<p>The Node.js project says end-of-life versions are always affected when a security release occurs. CloudLinux has backported fixes for some older alt-nodejs versions, but not for alt-nodejs10 or alt-nodejs19. Move applications on those versions to a supported line.<\/p>\n<h2 id=\"related-the-php-security-update\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> Related: the PHP security update<\/h2>\n<p>This is a separate issue from the PHP flaws CVE-2026-109618 and CVE-2026-109619. For those, see our <a href=\"https:\/\/underhost.com\/blog\/php-security-release-october-2026-patch-guide\/\">PHP critical security update guide<\/a>.<\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/cloudlinux.statuspage.io\/\">CloudLinux status page: Node.js security releases, October 2026<\/a><\/li>\n<\/ul>\n<p>Need help with an update? Open a ticket through <a href=\"https:\/\/customerpanel.ca\/client\/\">@CustomerPanel<\/a>.<\/p>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help putting this into practice?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Our team can review your setup and help you choose the right plan. Contact @CustomerPanel for support.<\/p>\n<p><a href=\"https:\/\/underhost.com\/shared-hosting.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">View hosting plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Which Node.js versions fix CVE-2026-111497?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Node.js 22.23.4, 24.22.1 and 26.12.1. Older Node.js lines are end of life and get no upstream fix.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Do I need to restart my applications after updating Node.js?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. A running application keeps using the old Node.js version until it is restarted. Restart every Node.js application after the update.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How do I check which Node.js version an application uses?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Run <code>node -v<\/code> in the same environment as the application. On cPanel and CloudLinux, also check the version selected for each application in Setup Node.js App.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">What if I use an end-of-life Node.js version?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">There is no upstream fix. CloudLinux has released backported fixes for some alt-nodejs versions, but the long-term fix is to move the application to a supported Node.js line.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Will UnderHost update Node.js on my server?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">On managed servers and servers with a management plan, our team applies these updates. On an unmanaged VPS or dedicated server, updating is your responsibility, and you can use the helper script in this guide.<\/p>\n<\/div>\n<\/div>\n<p><script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Which Node.js versions fix CVE-2026-111497?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Node.js 22.23.4, 24.22.1 and 26.12.1. Older Node.js lines are end of life and get no upstream fix.\"}}, {\"@type\": \"Question\", \"name\": \"Do I need to restart my applications after updating Node.js?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. A running application keeps using the old Node.js version until it is restarted. Restart every Node.js application after the update.\"}}, {\"@type\": \"Question\", \"name\": \"How do I check which Node.js version an application uses?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Run node -v in the same environment as the application. On cPanel and CloudLinux, also check the version selected for each application in Setup Node.js App.\"}}, {\"@type\": \"Question\", \"name\": \"What if I use an end-of-life Node.js version?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"There is no upstream fix. CloudLinux has released backported fixes for some alt-nodejs versions, but the long-term fix is to move the application to a supported Node.js line.\"}}, {\"@type\": \"Question\", \"name\": \"Will UnderHost update Node.js on my server?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"On managed servers and servers with a management plan, our team applies these updates. On an unmanaged VPS or dedicated server, updating is your responsibility, and you can use the helper script in this guide.\"}}]}<\/script><\/p>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/php-security-release-october-2026-patch-guide\/\">PHP Critical Security Update (October 2026): Patch Guide, CloudLinux Status, CERT-EU Advice and Mitigations<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/cve-2026-31431-copy-fail-linux-server-patch-guide\/\">CVE-2026-31431 \u2018Copy Fail\u2019: Why Linux Server Owners Should Patch Now<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/top-cpanel-security-tips-to-keep-your-hosting-environment-safe\/\">Top cPanel Security Tips to Keep Your Hosting Environment Safe<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/how-to-configure-modsecurity-in-cpanel-for-advanced-security\/\">How to Configure ModSecurity in cPanel for Advanced Security<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/cpanel-tutorial-security-ip-deny-manager\/\">cPanel Tutorial: Security &#8211; IP Deny Manager<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>On 21 October 2026, the Node.js project released security updates for its 22.x, 24.x and 26.x lines: Node.js 22.23.4, 24.22.1 and 26.12.1. They fix 10 vulnerabilities, and the highest severity is High. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can allow remote code execution. Update Node.js, then restart every Node.js application so it runs the new version.<\/p>\n","protected":false},"author":20904,"featured_media":6049,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,203,204],"tags":[110,108,115,188,185,186],"class_list":["post-5937","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-security","category-software-cms","tag-tag-cloudlinux","tag-tag-cpanel","tag-tag-linux-server","tag-patch","tag-php","tag-security-updates"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5937","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/20904"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=5937"}],"version-history":[{"count":10,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5937\/revisions"}],"predecessor-version":[{"id":6978,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/5937\/revisions\/6978"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/6049"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=5937"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=5937"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=5937"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}