PHP and Node.js release urgent security updates

Teams managing websites built with PHP and APIs using Node.js had to apply two sets of urgent security updates on Wednesday, October 21. These updates addressed critical vulnerabilities that had been anticipated for some time.

PHP patches two critical flaws

PHP released patches for two critical vulnerabilities on October 21. These issues had been expected since the previous day, prompting developers to prepare for the necessary updates to their systems.

Node.js fixes ten vulnerabilities

The Node.js project released three updated versions on the same day—22.23.4, 24.22.1, and 26.12.1—to fix ten vulnerabilities. Four of these are classified as high severity, with one allowing remote code execution on a server.

GitLab addresses a long-standing flaw

In the same week, GitLab fixed a critical vulnerability rated 10 out of 10, which had existed since 2014. This flaw was discovered and patched as part of ongoing security efforts.

Node.js is less widespread but used by major sites

Node.js, which allows JavaScript to run on servers, is less widespread than PHP in terms of the number of websites. According to W3Techs data from September 9, 2026, it serves as a web server for 7% of websites with known servers. However, it powers 22% of the 1,000 most visited websites.

Node.js followed its usual update schedule

The October 21 update was part of Node.js’s usual schedule, which had been announced in advance. Previous patches were released on July 29, and no leaks or attacks exploiting these vulnerabilities were reported before the update.

Most serious flaw affects Brotli decoder

The most serious vulnerability, CVE-2026-111497, affects the Brotli decoder in Node.js. Brotli is a compression format created by Google, used to reduce the size of web pages and data exchanged between servers.

Node.js updates several dependencies

Node.js also updated several dependencies, including c-ares, OpenSSL, SQLite, and Undici. It now blocks the eMudhra certificate authority, which has been compromised, and refuses certificate chains containing a revoked key.

Users advised to check and upgrade versions

Users are advised to check their installed Node.js version using the command node -v and upgrade to the corrected version of their branch. If applications run in containers, updating the machine is not enough—users must rebuild the images and restart the affected services.

End-of-life branches remain vulnerable

Node.js reminds users that end-of-life branches, such as Node.js 20, are affected by every security release but no longer receive patches. Developers using these branches should consider upgrading to supported versions.

PHP updates specific versions

PHP released corrected versions for 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older versions, including PHP 8.1 and earlier, received no updates, leaving them vulnerable to the same issues.