
Node.js released version 24.22.1, which fixes 7 security vulnerabilities. We're installing the patched versions on our hosting platform so your app is protected. Node.js 22 and 24 are being updated first. Node.js 20 and 18 will follow once their patches are available.
Our security team looked closely at the most serious of the fixed issues (CVE-2026-111497, a bug in how Node.js unpacks Brotli-compressed data). It can't be triggered by visitors coming to your website, there's no known exploit in the wild, and we've added extra protection on our side as a precaution.
If you’re on Hostinger hosting plans, nothing for you to do: no rebuild, no re-upload. After the update, we’ll restart your Node.js app so it runs the patched version. VPS users who run Node.js should update themselves
You can follow live updates from here:
Release notes: