Critical NodeJS Vulnerabilities (CVE-2026-105483, CVE-2026-106069, CVE-2026-111497)

Update timeline

1. investigating Oct 21, 2026, 09:09 PM UTC

   We're aware of several security vulnerabilities announced today by Node.js, affecting the 22.x, 24.x and 26.x release lines. We're reviewing the impact on our services and will apply the patched versions across our servers as soon as our vendors release them. We'll update this notice as more information becomes available.

2. investigating Oct 21, 2026, 10:12 PM UTC

   Several mitigation options have been identified whilst we await patched versions from our upstream partners. These are presently being rolled out by our team. We do not detect any signs of exploitation at the time of writing. We will continue to monitor and ensure that your accounts remain secure. Your patience and cooperation are greatly appreciated.

3. investigating Oct 21, 2026, 11:24 PM UTC

   A mitigation is currently being implemented for the Brotli RCE (CVE-2026-111497). Other mitigation options are being investigated for the other CVEs, and we are awaiting publication of patched packages by upstream.

4. investigating Oct 22, 2026, 02:21 AM UTC

   The Brotli RCE (CVE-2026-111497) has been mitigated fleet-wide, and on all customer servers that are managed by our team. We will continue to work on the remaining CVEs, applying mitigations where available and awaiting fixed versions from upstream. Thank you for your patience and cooperation.

5. investigating Oct 22, 2026, 03:02 PM UTC

   Our mitigation against the Brotli-related Node.js vulnerability remains deployed across our hosting fleet and all customer servers managed by our team. We are working closely with our upstream partners, who have confirmed that patched Node.js packages are now being made available through their release channels. Our team are now working diligently to roll these updates out across our fleet. We will keep you updated.

6. identified Oct 22, 2026, 04:10 PM UTC

   We are continuing to install the available Node.js security updates on our hosting servers. Node.js will be restarted on all servers once this is complete to ensure that the new binaries are being used. Please note that patched versions of alt-nodejs v16, v18 and v20, and ea-nodejs22 are still pending from upstream. We shall continue to work with our partners to ensure that updates to these remaining versions are applied immediately once they become available. Our mitigation against Brotli-compressed requests remains in place across our hosting fleet and managed customer servers. Our upstream provider has confirmed that this reduces exposure. Our Software team are also working hard to ensure that internal applications are patched and hardened against these vulnerabilities - keeping your accounts and our systems secure is of utmost importance to us. We will continue to update you throughout the process.

7. identified Oct 22, 2026, 04:50 PM UTC

   We have completed the rollout of the available Node.js 12, 14, 22, 24 and 26 security updates across our shared hosting fleet and restarted applications using the old versions where they can restart automatically. Our customer account gateway has also been patched in production. We are now focusing on completing updates and restarts on managed customer servers. Some vendor fixes remain outstanding, so this work is not yet complete. The mitigation against Brotli-compressed requests remains in place across our hosting fleet and managed servers.

8. identified Oct 22, 2026, 06:19 PM UTC

   Security updates for the previously outstanding Node.js 16, 18 and 20 packages, and the cPanel-provided Node.js 22 package, are now available from our upstream providers. We have begun rolling these updates out across our shared hosting fleet. We are also continuing checks across managed customer servers to establish the updates and application restarts required on each server before applying the patches. This work is still in progress.

9. identified Oct 22, 2026, 08:16 PM UTC

   We have completed the rollout of all currently available alt-nodejs security updates across our shared hosting fleet. All Node.js applications on the fleet, including customer-managed processes, have now been restarted to use the updated binaries. Our final checks found no processes still using the replaced versions. The additional protection against Brotli-compressed requests remains in place across our hosting fleet and managed customer servers. Work on managed customer servers is in progress, and we are continuing to track the remaining vendor fixes. This incident remains open while that work is completed.

10. identified Oct 22, 2026, 09:07 PM UTC

    We have now applied the available Node.js security updates to managed customer servers and restarted applications using the replaced binaries. The latest audit found no outstanding package updates or processes using replaced binaries. This follows completion of the shared hosting rollout. This does not yet address every affected Node.js installation. Some older, end-of-life versions and other vendor-provided packages still have no fixes available, and customer-installed copies require separate review. Customers using their own Node.js installations should check for security updates and move unsupported versions to a patched, supported release. Our additional protection against Brotli-compressed requests remains in place, but is not a complete substitute for patched software. This incident remains open whilst we continue to monitor and await further releases from upstream.