Websites
Node.js Security Update, October 2026: What Website Owners Should Do
On October 21, 2026, the team behind Node.js released security fixes. Four of the problems they fixed are rated high, which is the second-highest level. If your website or web app runs on Node.js, ask your developer to install the update this week.
What is Node.js?
Node.js is free software that many websites and web apps use behind the scenes. Think of it as an engine. You never see it, but it helps run things like booking pages, customer portals and online stores.
Most WordPress sites do not run on Node.js. But if your site was built as a modern web app, or you have a custom online system, it may. If you are not sure, that is the first thing to ask.
What happened
The Node.js team fixed 10 security problems. They released new versions for the three versions they still support (22, 24 and 26). Here is what they fixed, in plain words.
The most serious one
A problem in the part of Node.js that unpacks compressed data could let an attacker run their own code on your server. This is rated high. The Node.js team has not said that anyone is using it in attacks.
Three more rated high
- Two problems with the "is this the right server?" check. When Node.js connects to another server, it checks that the secure connection really belongs to that server. These two problems could let that check be fooled when the server's address is written in an unusual way.
- One problem with looking up website addresses. A tool that finds the address behind a website name could cut the name short and look up the wrong one.
Six smaller problems
Three are rated medium and three are rated low. They include another secure connection check issue, a case where random numbers could repeat in certain setups, and some problems with how Node.js limits what a program is allowed to touch on a server.
Extra updates inside the package
The release also updates several parts that Node.js depends on. One of them is its list of trusted certificate companies, which now reflects the weak certificates issued by a company called eMudhra.
Which versions are fixed
The fixed versions are:
- Node.js 22.23.4
- Node.js 24.22.1
- Node.js 26.12.1
Older versions that no longer get support are not part of this update. The Node.js team says these older versions are always affected when a security fix comes out. If your site runs on one, it needs to be moved to a supported version.
What to do this week
- Find out if your site uses Node.js. Ask whoever built it or whoever hosts it.
- Ask which version it runs. If it is one of the three above and older than the fixed number, it needs the update.
- Ask for the update to be installed, and the site restarted. The fix only takes effect after a restart.
- Ask about older versions. If your site runs on an unsupported version, ask for a plan to move it.
- Keep a backup before any update, in a place that is not on your host.
The simple lesson
The quiet software underneath your website needs updates too, not only the plugins and themes you can see. Security fixes are most useful when they are installed in days, not months. Make sure someone is clearly in charge of this for your site.
Keeping this software up to date is part of Website Care, one of our services. Not sure where your website stands? Ask us for a free quote and we will check it and tell you honestly.
Questions about this topic
Does my WordPress website need this update?
Most WordPress sites do not run on Node.js, so this update usually does not apply. If your site is a custom web app or online system, ask your developer.
Is my website already hacked?
Not necessarily. This is a warning to update, and the Node.js team has not said anyone is attacking with these problems. If you see strange pages or spam, tell your website person.