Node.js and Next.js security updates: what to ask your developer

Last checked October 21, 2026, at 10 p.m. Eastern.

PHP2Shell took the headlines on October 21, 2026, but it wasn’t the only security release that day. Node.js, the JavaScript runtime behind many custom web apps, APIs and modern marketing sites, shipped fixes for 10 vulnerabilities. A week earlier, Next.js, one of the most popular frameworks built on Node, patched two critical flaws of its own.

Neither is a hack in progress. As of October 21, no attacks on the Node.js flaws had been reported. These are patches to install before someone figures out how to use the bugs. If your business runs on a custom app or a Next.js site, this post covers what changed and what to ask whoever maintains it.

If your site runs on WordPress, the PHP news matters more to you. Start with our PHP2Shell guide.

What did Node.js fix on October 21?

Node.js released 26.12.1, 24.22.1 and 22.23.4, fixing 10 vulnerabilities, 4 of them rated high. The most serious is a memory bug in Node’s Brotli decompression, CVE-2026-111497, which the Node.js project says can allow remote code execution. Two other high-severity fixes close ways around TLS certificate checks, and a fourth fixes how one DNS function handles certain names.

The release also updated Node’s built-in list of trusted certificate authorities to drop certificates tied to the eMudhra key compromise, which is covered below.

Is my app affected?

If it runs on any Node.js version older than the three fixed releases, yes. How exposed it is depends on what the app does.

The apps with the most to worry about fetch content from addresses that other people supply: link previews, URL importers, image proxies, feed readers, scrapers and webhook handlers. Brotli is a compression format, and researchers who studied the fix say the bug can be reached when an app pulls a compressed response from a server an attacker controls. The Node.js advisory itself doesn’t spell out the path. Public APIs that accept compressed request bodies deserve a look too.

The lowest-risk case is a static site that only uses Node at build time and pulls from trusted sources. Update anyway, but it isn’t an emergency.

What about old Node versions?

Node 20 reached end of life on April 30, 2026, and Node 25 on June 1, 2026. Neither gets these fixes, and the Node.js project says end-of-life versions are always affected by a security release. If your app is on either one, the only fix is moving to 22, 24 or 26.

For most business apps, Node 24 is the safe target. It’s in long-term support until April 2028. Node 22 is in maintenance until April 2027, and Node 26 becomes a long-term support release on October 28, 2026.

What did Next.js fix on October 14?

Next.js released 16.4.1 and 15.5.28 to fix two critical remote code execution flaws and a high-severity denial-of-service bug. One critical flaw affects Next.js 16 apps that use the App Router with Cache Components. The other sits in the image optimizer’s handling of SVG files on common Linux servers and reaches back to Next.js 10.

The Next.js team says there’s no workaround for the first flaw, so upgrade even if you think you don’t use the feature. For the image optimizer flaw, updating the sharp image library to 0.35.5 or later is a stopgap until the upgrade lands.

Do hosting platforms update Node for me?

Some do, some don’t, and the difference catches people out. Several managed platforms apply patch releases automatically on your next deploy. Others pin the exact version your app first deployed with until you change it. Containers are always your job: an app in a Docker image keeps the Node version it was built with until someone rebuilds the image.

The safe move is the same everywhere. Redeploy, then confirm the Node version the app actually runs, from the build log or by having the app report process.version.

Does the eMudhra certificate problem affect my site?

Probably not, but it takes one minute to check. eMudhra, a certificate authority, had private keys for several intermediate certificates exposed, which could let someone forge certificates. Chrome blocked the affected certificates on October 17 and plans to remove the “emSign ECC Root CA - G3” root around October 27.

Click the padlock in your browser’s address bar on your own site and look at who issued the certificate. If the chain ends at that root, get a replacement certificate from another provider before October 27, or visitors will start seeing errors.

What should I ask my developer?

Five questions cover it:

1. Which Node.js version does each of our apps and build systems run? The answer should be 22.23.4, 24.22.1, 26.12.1 or later.
2. Are we on Next.js 16.4.1 or 15.5.28 or later? If the app uses Next.js at all, this applies.
3. Does anything we run fetch URLs that customers or outsiders provide? That’s where the Brotli fix matters most.
4. When did each container image last get rebuilt? An image built before October 21 still carries the old Node.
5. Is anything on Node 20 or 25? Those need a version upgrade, since no patch is coming.

A good developer can answer all five in a short email. If nobody can, that tells you something too.

Need help with an app nobody maintains?

Plenty of Tampa Bay companies have a booking portal, customer dashboard or marketing site that a contractor built and then moved on from. When security news like this lands, nobody’s watching it.

We build our own site with Node, and we moved our own build machine to the patched release this week. We can do the same for yours: find out what versions you’re running, upgrade Node and Next.js, rebuild and redeploy, and check that everything still works. Call 813-531-9400 and we’ll pick up and start right away, or reach us through emergency support. For ongoing coverage, our website care plans keep the stack current every month.

Common questions

Is Node.js less secure than PHP? No. Both projects find and fix serious bugs every year. What matters is whether someone applies the fixes, and that’s a maintenance question more than a technology one.

Does a static site generator like Astro need this update? Update the machine that builds the site. If the built site is static files on a host like Cloudflare Pages, visitors never touch Node, so the exposure is limited to the build step.

How urgent is this compared to PHP2Shell? Less urgent for most small businesses. PHP2Shell affects nearly every WordPress site and drew government warnings to take sites offline. The Node.js fixes matter most for custom apps that fetch outside content, and no attacks had been reported as of October 21.