The Node.js security fix from October 21 and who needs it

If your website or web app runs on Node.js, make sure it has the Node.js update from October 21, 2026.

Node.js is the software that runs a lot of modern websites and apps behind the scenes. On October 21, 2026, the Node.js team fixed 10 security holes in it. This came out the same day as the PHP2Shell fix, so it got less attention.

The one to worry about

The biggest fix is for a bug in Brotli, a format websites use to shrink data before sending it. Node has a built-in tool that unpacks Brotli data, and that tool had a bug.

If an app unpacks Brotli data that an attacker sent, the attacker can mess with the app's memory. Node.js says that can crash the app or leak data from its memory. In the worst case, the attacker could run their own code.

Node rated it High. Singapore's national cybersecurity agency rated it 9.8 out of 10. Experts often disagree on these scores.

Is anyone using it yet?

Not that anyone has reported. As of October 22, there were no known attacks. A researcher posted test code that same day, but it only took over a specially weakened copy of Node. On a normal copy it crashed the app and leaked a little memory, according to The Hacker News.

That's good news, but these things can change fast once working code is public.

Who needs to do something

Sites on Squarespace, Wix, Shopify, or WordPress. You can stop here. Those don't run Node.js in a way you control.

Sites hosted on Vercel. Vercel added firewall rules on October 21 that block this attack for every project. It's also updating Node for projects on versions 22 and 24 by itself. If your project is still on Node 20, someone needs to switch it to 22 or 24 and redeploy, since Node 20 won't get this fix.

Sites or apps on your own server. This is the group that needs to act. Whoever manages it should update Node and restart the app. The fixed versions are 22.23.4, 24.22.1, and 26.12.1. Ask your developer which version you're on.

Anything still on Node 20 or older. Those versions are past their support date and won't get a fix at all. Upgrading is the only answer.

What about our clients?

The sites we build at SiteLaunch run on Vercel, so they got the firewall protection on day one. Vercel is rolling out the Node update to them on its own, and our clients don't need to do anything.

Not sure what your site runs on?

If you don't know whether your site uses Node.js, or your developer isn't answering, send me a message. I can help you figure out what your site is built on and who hosts it, so you know whether any of this applies to you.

This post covers the facts as of October 24, 2026.