Node.js October 2026 Security Release: What It Means for Virto Commerce
TL;DR
- Node.js fixed ten vulnerabilities on October 21, 2026, four of them high severity.
- A running Virto Commerce store is not affected, because the platform runs on .NET 10, and the storefront and admin UI are served as static files.
- Node.js is used to build the storefront and admin UI, so update it on your build agents to 22.23.4, 24.22.1 or 26.12.1.
What Happened
On October 21, 2026, the Node.js project shipped security releases that fix ten vulnerabilities across its three supported release lines. Four are rated high. The most serious is an out-of-bounds write in the Brotli decoder that can allow remote code execution.
|
CVE
|
Issue
|
Severity
|
|---|---|---|
|
CVE-2026-111497
|
Brotli decoder out-of-bounds write, can allow remote code execution
|
High
|
|
CVE-2026-106069
|
TLS certificate hostname check bypassed when a host loosely resolves to an IP address
|
High
|
|
CVE-2026-105483
|
TLS certificate hostname check bypassed with an IP written in fullwidth digits (24.x, 26.x)
|
High
|
|
CVE-2026-105482
|
dns.resolve truncates names containing a NUL character
|
High
|
The other six are rated medium or low. The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node.js notes that end-of-life versions, such as 20.x, are always affected and receive no fix.
How Virto Commerce Is Affected
The Virto Commerce platform does not run Node.js in production, so these vulnerabilities do not reach a running Virto Commerce store. The platform runs on .NET 10, a long-term support release under Microsoft's support policy. The storefront and the admin UI are delivered as static files.
Node.js does appear in one place: the build. It compiles the Virto Frontend and the admin UI into those static files. A build machine running an unpatched Node.js is the exposure to close.
|
Part of the stack
|
What runs it in production
|
Node.js in production
|
Node.js at build time
|
|---|---|---|---|
|
Platform (backend)
|
.NET 10
|
No
|
No
|
|
Virto Frontend
|
Static files served from storage, a web server or a CDN
|
No
|
Yes (Virto Cloud CI: nothing affected so far)
|
|
Admin UI
|
Static files served by the platform
|
No
|
Yes (Virto Cloud CI: nothing affected so far)
|
|
Official platform Docker image
|
.NET 10 runtime image
|
No
|
Not applicable
|
If you added your own Node.js services around Virto Commerce, such as a custom backend-for-frontend, a server-side rendering layer or a self-hosted prerender service, those run Node.js in production and need the patch too.
What to Do
If your team builds the Virto Frontend, the admin UI or custom modules, update Node.js wherever those builds run.
- Update Node.js on every CI/CD build agent to a fixed release: 22.23.4, 24.22.1 or 26.12.1, matching the line you use.
- Check the places that pin a Node.js version:
.nvmrc, theenginesfield inpackage.json, thenode-versionin your CI workflows, and anynode:base image in your build containers. Raise each pin to a fixed release. - Update Node.js on developer machines that build locally.
- If any build still runs on Node.js 20 or another end-of-life line, move it to 22 or 24. End-of-life lines get no fix.
- Patch any Node.js service you run in production alongside Virto Commerce, as described above.
No change to the Virto Commerce platform itself is needed.
Virto Cloud Customers
Our infrastructure team is reviewing every Virto Cloud service against these vulnerabilities. The review has found nothing affected so far. We will update this post when the Virto Cloud review is complete.
Until then, Virto Cloud customers have nothing to change in their Virto Cloud environment. If your team builds the storefront or custom modules itself, the build steps above still apply.
