Node.js Security Release: CVE-2026-111497
On October 21, 2026, Node.js released fixes for 10 security vulnerabilities. The most serious is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that allows remote code execution.
Web Hosting Plans
Section titled “Web Hosting Plans”Hawk Host uses CloudLinux to provide Node.js hosting. CloudLinux is providing updates not only for supported Node.js versions but also for end-of-life versions.
Current Status
Section titled “Current Status”The following versions have been updated:
- Node.js 16
- Node.js 18
- Node.js 20
- Node.js 22
- Node.js 24
- Node.js 26
CloudLinux is working on updates for the following other versions:
- Node.js 12
- Node.js 14
Mitigation
Section titled “Mitigation”Until patches are available, we recommend limiting your exposure to Brotli. That would mean avoiding decoding Brotli data from sources you do not trust. That would mean not only retrieving third-party content but also handling user-uploaded data.
Virtual Private Servers
Section titled “Virtual Private Servers”For Virtual Private Servers, you should upgrade to a supported version as soon as possible. You will need to refer to your specific deployment stack on how you can update.