Incident Report

Security update: Node.js vulnerabilities

October 21, 2026. Status: resolved. No downtime.

S

Sitery Team

Northern Nevada

Summary

The Node.js project released 22.23.4, 24.22.1 and 26.12.1 to fix several vulnerabilities. The most severe, CVE-2026-111497, allows remote code execution. The Node.js runtimes used by Sitery Next.js sites now run patched releases. There was no downtime.

Timeline

  • October 21: Node.js releases 22.23.4, 24.22.1 and 26.12.1.
  • October 21: Sitery rebuilds the Next.js site runtimes on patched releases.

Cause

The release fixes the following issues, among others:

  • CVE-2026-111497 (high): an out-of-bounds write in Node’s Brotli decoder that can allow remote code execution.
  • CVE-2026-106069 and CVE-2026-105483 (high): TLS hostname verification can be bypassed with unusual IP address forms.
  • CVE-2026-105482 (high): dns.resolve truncates names containing a NUL character.
  • Updated trust list removing the compromised eMudhra certificate authority, covered in a separate report.

End-of-life Node.js versions, including Node.js 20, are affected and will not receive fixes.

Exposure

  • The Node.js 22 and 24 runtimes used by Sitery Next.js sites were on 22.23.3 and 24.21.0.
  • WordPress sites do not run Node.js and were not affected.

What we did

  • Rebuilt the Next.js runtimes on 22.23.4 and 24.22.1. New deployments use them automatically.
  • Confirmed both runtimes report the patched versions.

What you need to do

Nothing for sites hosted on Sitery.

If you deploy with the sitery command-line tool, it runs on the Node.js installed on your own computer. Update it to 22.23.4, 24.22.1, 26.12.1 or later. Check your version with node -v.