Security alert: Please update Node.js to address the October 2026 vulnerabilities

[jhuckaby]

Security alert: Please update Node.js to address the October 2026 vulnerabilities

Hi everyone! Please plan to update Node.js on your xyOps servers as soon as possible. The October 2026 security releases address several vulnerabilities, including a Brotli decompression flaw that can lead to remote code execution.

The xyOps v1.1.11 Docker image includes Node.js v24.22.1, the latest Node.js v24 release as of October 25, 2026, with all of these Node.js security fixes applicable to v24 included. See the xyOps v1.1.11 release.

Which Node.js versions should I install?

Update to the following patched version, or a newer release in the same supported release line:

Your Node.js release line	Minimum patched version
22.x	22.23.4
24.x	24.22.1
26.x	26.12.1

If you are running an end-of-life version, move to a supported release line. See the official Node.js security announcement for release details and downloads.

What was fixed?

The Node.js advisory states:

The highest severity issue fixed in this release is HIGH.

Highlights include:

• Brotli memory corruption (CVE-2026-111497): Decompressing malicious Brotli data can cause crashes, expose process memory, or potentially execute attacker-controlled code.
• DNS and TLS validation flaws: Crafted hostnames can bypass hostname validation or cause certificates to be accepted for the wrong endpoint.
• Other fixes: HTTP keep-alive response handling, repeated random values in startup snapshots, Permission Model bypasses, and ZIP validation. Affected release lines vary by issue.

See the Node.js advisory for the complete list.

Brotli exposure extends beyond Node.js

Aikido's write-up on CVE-2026-111497, also called Node2Shell or HTTP2Shell, explains that other software bundling the vulnerable Brotli decoder is affected too. HTTP clients can encounter the flaw when decoding malicious compressed responses, so exposure is not limited to public-facing servers.

If your jobs use Python, check their environments for the Brotli and brotlicffi packages. The patched versions are Brotli 1.2.1 and brotlicffi 1.2.1.0, or later. These packages can be installed indirectly through other dependencies.

What should xyOps users do?

Warning

The xyOps conductor's self-upgrade mechanism only updates the xyOps software itself. It does not upgrade Node.js. Self-upgrading to xyOps v1.1.11 alone will not apply these Node.js security fixes. This update requires special care: upgrade Node.js separately for native installations, or deploy the updated Docker image as described below.

• Official Docker image: Upgrade to the xyOps v1.1.11 image and recreate your containers using the updated image. Pulling an image alone does not update an already-running container.
• Native installations: Update Node.js separately on every xyOps conductor and xySat worker, then restart the affected services. Updating xyOps alone does not replace your system's Node.js runtime.
• Job environments and custom images: Check any additional Node.js runtimes and Brotli dependencies used by your jobs. Updating the xyOps image does not update separate worker hosts, job containers, or Python environments.

You can check a Node.js installation with:

node --version

For Docker, check inside the running container:

docker exec <container-name> node --version

For native services, verify the Node.js executable actually used by the service, since your interactive shell may select a different installation.

Please prioritize these updates and confirm that your running services are using the patched versions. Thanks everyone!