Skip to content

Node.js security update (CVE-2026-111497)

On 21 October Node.js released fixes for ten vulnerabilities, the most serious a Brotli decoder flaw that can allow remote code execution (CVE-2026-111497). Our servers now run the patched Node.js releases, and we disabled an end-of-life Node.js version. Our websites and applications stayed online, and all services are operating normally.

Major Resolved

Updates

Timeline

  1. Identified

    On 21 October the Node.js project released fixes for ten vulnerabilities, including a flaw in its Brotli decoder that can allow remote code execution (CVE-2026-111497). We are updating Node.js on our servers and restarting the services that use it.

  2. Resolved

    Our servers are now on the patched Node.js releases (22.23.4, 24.22.1 and 26.12.1). Every service that uses Node.js has been restarted on the patched version, and we disabled the end-of-life Node.js 23. All our websites, applications and API & infrastructure are running normally, and monitoring shows every check passing. You don't need to do anything.