Not only PHP, but three version branches of Node.js are also affected by high-severity vulnerabilities; users need to promptly update their runtime environments.

October 22 - The Node.js project released a security update on October 21, covering the 26.x, 24.x, and 22.x version branches, with fixes in versions 26.12.1, 24.22.1, and 22.23.4 respectively. The advisory lists a total of 10 vulnerabilities, including 4 high-severity, 3 medium-severity, and 3 low-severity issues, with the affected scope varying across version branches.

Among them, the high-severity vulnerability CVE-2026-111497 involves an out-of-bounds write in the Brotli decoder that can lead to remote code execution, affecting all three version branches. Other high-severity issues include null character handling in DNS resolution and a TLS certificate hostname verification bypass.

The update also fixes issues in persistent connection response handling, random number cache duplication, and the permission model, and updates dependencies including c-ares, OpenSSL, and Undici. The official team reminds users that end-of-life versions may also be affected by security vulnerabilities and that users should use the latest supported versions.

As previously reported, PHP fixed two critical vulnerabilities that could lead to unauthenticated remote code execution, with fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the official team urged users to upgrade immediately.