No impact incident

CloudLinux: Node.js security releases, October 2026: CVE-2026-111497 and 9 other CVEs

Affected: Node.js Selector

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Oct 22, 2026, 10:28 UTC
   identified
   On 21 October 2026 the Node.js project published security releases for the 22.x, 24.x and 26.x lines (v22.23.4, v24.22.1, v26.12.1). They fix 10 vulnerabilities, and the highest severity is High. The most serious one, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can allow remote code execution. The Node.js project notes that end-of-life versions are always affected when a security release occurs. We are aware and are building updated alt-nodejs packages for CloudLinux OS, including the end-of-life Node.js versions we ship. They are not released yet. We will post an update here as soon as fixed packages are available in the repositories, with steps to install them. Upstream advisory: Node.js October 2026 security releases
2. Oct 22, 2026, 10:49 UTC
   identified
   Fixed builds are being built now for CloudLinux OS 7, 8 and 9 and TuxCare 7, 8, 9 and 10: - Node.js 22: version 22.23.4 - Node.js 24: version 24.22.1 - Node.js 26: version 26.12.1 - ea-nodejs22 (cPanel): version 22.23.4 These are the same versions as the Node.js project's fixed releases. We expect them in the stable repositories in about 2 hours, by 12:40 UTC. Builds for older alt-nodejs versions are also in progress, and we will post their status here separately. We will post the exact package versions and the update steps once the packages are available in the repositories.
3. Oct 22, 2026, 13:33 UTC
   identified
   Fixed alt-nodejs 22, 24 and 26 are being released for CloudLinux OS 8 and 9 - alt-nodejs22: alt-nodejs22-nodejs-22.23.4-1 - alt-nodejs24: alt-nodejs24-nodejs-24.22.1-1 - alt-nodejs26: alt-nodejs26-nodejs-26.12.1-1 They are reaching servers gradually, so dnf upgrade may not find them on your server yet. We will confirm here when they are available on all servers. To update: dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*' Then restart your Node.js applications so they run the updated version. To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later: rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs Still in progress: ea-nodejs22 (cPanel), CloudLinux OS 7, and older alt-nodejs versions. We will post them here as they become available.
4. Oct 22, 2026, 13:59 UTC
   identified
   Fixed alt-nodejs 22, 24 and 26 are now in the stable repositories for CloudLinux OS 8 and 9 They have moved from the gradual rollout to stable, so a regular update installs them: dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' 'alt-nodejs26*' Then restart your Node.js applications so they run the updated version. To confirm, check the version, which should be 22.23.4, 24.22.1 or 26.12.1 or later: rpm -q alt-nodejs22-nodejs alt-nodejs24-nodejs alt-nodejs26-nodejs Older alt-nodejs versions: fixed builds of alt-nodejs 12, 14, 16, 18 and 20 are being released, and we expect them for all CloudLinux OS versions by 16:00 UTC. Still in progress: ea-nodejs22 (cPanel) and alt-nodejs for CloudLinux OS 7.
5. Oct 22, 2026, 15:03 UTC
   identified
   Fixed alt-nodejs 12 and 14 are now in the stable repositories - alt-nodejs12: alt-nodejs12-nodejs-12.22.12-35 , for CloudLinux OS 7, 8 and 9 - alt-nodejs14: alt-nodejs14-nodejs-14.21.3-37 , for CloudLinux OS 7, 8 and 9 - alt-nodejs24 is now also in stable for CloudLinux OS 10 To update: CloudLinux OS 7: yum clean all && yum update 'alt-nodejs12*' 'alt-nodejs14*' CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs12*' 'alt-nodejs14*' Then restart your Node.js applications. For these versions the CVE IDs are listed in the package changelog: rpm -q --changelog alt-nodejs14-nodejs | grep -E 'CVE-2026-' If you run your own mirror of our repositories, make sure it has synced since 14:50 UTC. Still in progress: alt-nodejs 16, 18 and 20, and ea-nodejs22 (cPanel).
6. Oct 22, 2026, 17:46 UTC
   identified
   Fixed alt-nodejs 16, 18 and 20 and ea-nodejs22 are now in the stable repositories - alt-nodejs16: alt-nodejs16-nodejs-16.20.2-33 , for CloudLinux OS 7, 8 and 9 - alt-nodejs18: alt-nodejs18-nodejs-18.20.8-26 , for CloudLinux OS 7, 7 Hybrid, 8 and 9 - alt-nodejs20: alt-nodejs20-nodejs-20.20.2-15 , for CloudLinux OS 7, 8 and 9 - ea-nodejs22 (cPanel EasyApache 4): ea-nodejs22-22.23.4-1.el8.cloudlinux , for CloudLinux OS 8 To update: CloudLinux OS 7: yum clean all && yum update 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*' CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs16*' 'alt-nodejs18*' 'alt-nodejs20*' cPanel servers on CloudLinux OS 8: dnf upgrade ea-nodejs22 Then restart your Node.js applications. For alt-nodejs 16, 18 and 20 the CVE IDs are listed in the package changelog. Fixed builds are now available for alt-nodejs 12, 14, 16, 18, 20, 22, 24 and 26 on CloudLinux OS 8 and 9, and alt-nodejs 12, 14, 16, 18 and 20 on CloudLinux OS 7. alt-nodejs22 for CloudLinux OS 7 has been released and is reaching the repositories now. Fixed builds for other older versions, such as alt-nodejs10 and alt-nodejs19, are not released. We will post here if that changes. This incident covers alt-nodejs and ea-nodejs22. The operating system's own nodejs packages will be updated when the fix arrives through the regular RHEL / AlmaLinux updates.
7. Oct 23, 2026, 04:27 UTC
   identified
   Fixed alt-nodejs 10 and 19 are now in the stable repositories - alt-nodejs10: alt-nodejs10-nodejs-10.24.1-7 , for CloudLinux OS 7, 8, and 9. - alt-nodejs19: alt-nodejs19-nodejs-19.9.0-10 , for CloudLinux OS 7, 8, and 9. To update: CloudLinux OS 7: yum clean all && yum update 'alt-nodejs10*' 'alt-nodejs19*' CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs10*' 'alt-nodejs19*' Then restart your Node.js applications.
8. Oct 26, 2026, 13:10 UTC
   identified
   Fixed alt-nodejs22 and alt-nodejs24 release 2 are now in the stable repositories for CloudLinux OS 8 and 9 and for CloudLinux OS for Ubuntu 22.04. They add a fix for CVE-2026-106071, a flaw in the Node.js permission model where a wildcard grant such as --allow-fs-read=/tmp/test* also allowed access to /tmp/tes . Upstream lists it for Node.js 26 only, but we reproduced it on 22 and 24 and fixed it there. - alt-nodejs22-nodejs-22.23.4-2 - alt-nodejs24-nodejs-24.22.1-2 If you already installed release 1, update again. CloudLinux OS 8, 9: dnf clean all && dnf upgrade 'alt-nodejs22*' 'alt-nodejs24*' Ubuntu 22.04: apt-get update && apt-get install --only-upgrade 'alt-nodejs*' alt-nodejs26-nodejs-26.12.1-1 already includes this fix from upstream. Correction to our update of 22 October, 17:46 UTC. alt-nodejs22 was never released for CloudLinux OS 7, so there is nothing to install there. Node.js 22 is available for CloudLinux OS 8 and 9 only. All other fixed packages are in the stable repositories. Fixed releases for CloudLinux OS 7, 8 and 9: - alt-nodejs10-nodejs-10.24.1-7 - alt-nodejs12-nodejs-12.22.12-35 - alt-nodejs14-nodejs-14.21.3-37 - alt-nodejs16-nodejs-16.20.2-33 - alt-nodejs18-nodejs-18.20.8-26 - alt-nodejs19-nodejs-19.9.0-10 - alt-nodejs20-nodejs-20.20.2-15 Fixed releases for CloudLinux OS for Ubuntu 22.04: - alt-nodejs12-nodejs 12.22.12-33 - alt-nodejs14-nodejs 14.21.3-35 - alt-nodejs16-nodejs 16.20.2-32 - alt-nodejs18-nodejs 18.20.8-26 - alt-nodejs20-nodejs 20.20.2-14 cPanel (EasyApache 4) on CloudLinux OS 8 gets ea-nodejs22-22.23.4-1.el8.cloudlinux . alt-nodejs6 , alt-nodejs8 , alt-nodejs9 and alt-nodejs11 are not patched, upgrade to a supported line. alt-nodejs packages carry their own copy of Brotli, so the fix for CVE-2026-111497 is inside the package and you do not need to update the system brotli package for them. The system brotli package on CloudLinux OS 8, 9 and 10 comes from AlmaLinux and has no fix yet. For details, see the TuxCare CVE tracker . To check a package on CloudLinux OS, compare its version with the lists above, for example: rpm -q alt-nodejs16-nodejs On Ubuntu: dpkg-query -W alt-nodejs16-nodejs TuxCare builds of the alt-nodejs versions are released for the platforms they support. For AlmaLinux ESU, the native nodejs 16 package fixes CVE-2026-105481, CVE-2026-105482 and CVE-2026-106069, and the brotli package fixes CVE-2026-111497: - AlmaLinux 9.2 ESU: nodejs-16.20.2-8.el9_2.tuxcare.els24 and brotli-1.0.9-7.el9_2.tuxcare.els2 - TuxCare 9.6 ESU: nodejs-16.20.2-8.el9_6.tuxcare.els24 and brotli-1.0.9-7.el9_5.tuxcare.els2 - TuxCare 9.8 ESU: nodejs-16.20.2-8.el9_8.tuxcare.els24 and brotli-1.0.9-10.el9_8.tuxcare.els1 Restart your Node.js applications after updating.

Updates as published by CloudLinux (original).