Node.js security releases, October 2026: CVE-2026-111497 and 9 other CVEs

Incident Report for CloudLinux

Update

Fixed alt-nodejs 16, 18 and 20 and ea-nodejs22 are now in the stable repositories

- alt-nodejs16: alt-nodejs16-nodejs-16.20.2-33, for CloudLinux OS 7, 8 and 9
- alt-nodejs18: alt-nodejs18-nodejs-18.20.8-26, for CloudLinux OS 7, 7 Hybrid, 8 and 9
- alt-nodejs20: alt-nodejs20-nodejs-20.20.2-15, for CloudLinux OS 7, 8 and 9
- ea-nodejs22 (cPanel EasyApache 4): ea-nodejs22-22.23.4-1.el8.cloudlinux, for CloudLinux OS 8

To update:
CloudLinux OS 7: yum clean all && yum update 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*'
CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*'
cPanel servers on CloudLinux OS 8: dnf upgrade ea-nodejs22
Then restart your Node.js applications. For alt-nodejs 16, 18 and 20 the CVE IDs are listed in the package changelog.

Fixed builds are now available for alt-nodejs 12, 14, 16, 18, 20, 22, 24 and 26 on CloudLinux OS 8 and 9, and alt-nodejs 12, 14, 16, 18 and 20 on CloudLinux OS 7. alt-nodejs22 for CloudLinux OS 7 has been released and is reaching the repositories now.

Fixed builds for other older versions, such as alt-nodejs10 and alt-nodejs19, are not released. We will post here if that changes.

This incident covers alt-nodejs and ea-nodejs22. The operating system's own nodejs packages will be updated when the fix arrives through the regular RHEL / AlmaLinux updates.

Posted Oct 22, 2026 - 17:46 UTC

Update

Fixed alt-nodejs 12 and 14 are now in the stable repositories

- alt-nodejs12: alt-nodejs12-nodejs-12.22.12-35, for CloudLinux OS 7, 8 and 9
- alt-nodejs14: alt-nodejs14-nodejs-14.21.3-37, for CloudLinux OS 7, 8 and 9
- alt-nodejs24 is now also in stable for CloudLinux OS 10

To update:
CloudLinux OS 7: yum clean all && yum update 'alt-nodejs12*' 'alt-nodejs14*'
CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs12*' 'alt-nodejs14*'
Then restart your Node.js applications.

For these versions the CVE IDs are listed in the package changelog:
rpm -q --changelog alt-nodejs14-nodejs | grep -E 'CVE-2026-'

If you run your own mirror of our repositories, make sure it has synced since 14:50 UTC.

Still in progress: alt-nodejs 16, 18 and 20, and ea-nodejs22 (cPanel).

Posted Oct 22, 2026 - 15:03 UTC

Update

Fixed alt-nodejs 22, 24 and 26 are now in the stable repositories for CloudLinux OS 8 and 9

They have moved from the gradual rollout to stable, so a regular update installs them:
dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*'
Then restart your Node.js applications so they run the updated version.

To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later:
rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs

Older alt-nodejs versions: fixed builds of alt-nodejs 12, 14, 16, 18 and 20 are being released, and we expect them for all CloudLinux OS versions by 16:00 UTC.

Still in progress: ea-nodejs22 (cPanel) and alt-nodejs for CloudLinux OS 7.

Posted Oct 22, 2026 - 13:59 UTC

Update

Fixed alt-nodejs 22, 24 and 26 are being released for CloudLinux OS 8 and 9

- alt-nodejs22: alt-nodejs22-nodejs-22.23.4-1
- alt-nodejs24: alt-nodejs24-nodejs-24.22.1-1
- alt-nodejs26: alt-nodejs26-nodejs-26.12.1-1

They are reaching servers gradually, so dnf upgrade may not find them on your server yet. We will confirm here when they are available on all servers.

To update:
dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*'
Then restart your Node.js applications so they run the updated version.

To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later:
rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs

Still in progress: ea-nodejs22 (cPanel), CloudLinux OS 7, and older alt-nodejs versions. We will post them here as they become available.

Posted Oct 22, 2026 - 13:33 UTC

Update

Fixed builds are being built now for CloudLinux OS 7, 8 and 9 and TuxCare 7, 8, 9 and 10:
- Node.js 22: version 22.23.4
- Node.js 24: version 24.22.1
- Node.js 26: version 26.12.1
- ea-nodejs22 (cPanel): version 22.23.4

These are the same versions as the Node.js project's fixed releases. We expect them in the stable repositories in about 2 hours, by 12:40 UTC.

Builds for older alt-nodejs versions are also in progress, and we will post their status here separately. We will post the exact package versions and the update steps once the packages are available in the repositories.

Posted Oct 22, 2026 - 10:49 UTC

Identified

On 21 October 2026 the Node.js project published security releases for the 22.x, 24.x and 26.x lines (v22.23.4, v24.22.1, v26.12.1). They fix 10 vulnerabilities, and the highest severity is High. The most serious one, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can allow remote code execution. The Node.js project notes that end-of-life versions are always affected when a security release occurs.

We are aware and are building updated alt-nodejs packages for CloudLinux OS, including the end-of-life Node.js versions we ship. They are not released yet. We will post an update here as soon as fixed packages are available in the repositories, with steps to install them.

Upstream advisory: Node.js October 2026 security releases

Posted Oct 22, 2026 - 10:28 UTC

This incident affects: CloudLinux OS Components (Node.js Selector).