Question ETA for critical PHP security updates (CVE-2026-109618 / CVE-2026-109619)?

[Harm Jakob Tolsma]

Finally - Good night!

Keep an eye on this and GitLab as well:

• Security vulnerabilities: On October 21, 2026, Node.js disclosed 10 security vulnerabilities, including 4 rated high severity. The most critical, CVE-2026-111497, is a Brotli decoder memory corruption flaw that could potentially enable Remote Code Execution (RCE).
• Affected versions: Node.js 22.x, 24.x, and 26.x before the respective security updates. Older, unsupported versions may also be vulnerable.
• Security patches available: Fixed in Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026. Other high-severity CVEs include CVE-2026-105482, CVE-2026-105483, and CVE-2026-106069, affecting DNS and TLS security checks.
• Source: Official Node.js Security Advisory

I'd like to be able to patch these anytime soon too. What is the proper way?

 

[learning_curve]

I'd like to be able to patch these anytime soon too. What is the proper way?

You can view / install / uninstall versions, via the Plesk Node.js Toolkit Extension, or, view the released (installed) versions via: # plesk ext nodejs --versions
If your Plesk install is fully up to date, you should see that all of the 22.23.4, 24.22.1, and 26.12.1 Node.js releases (i.e. the patched ones) are already present.
Ours are, so there was no actual work necessary (for us)

 

[Harm Jakob Tolsma]

You can view / install / uninstall versions, via the Plesk Node.js Toolkit Extension, or, view the released (installed) versions via: # plesk ext nodejs --versions
If your Plesk install is fully up to date, you should see that all of the 22.23.4, 24.22.1, and 26.12.1 Node.js releases (i.e. the patched ones) are already present.
Ours are, so there was no actual work necessary (for us)

Mine are behind and I dont see any update options. Only the 'refresh' button, but that doesnt do very much.

 

[learning_curve]

Mine are behind and I dont see any update options. Only the 'refresh' button, but that doesnt do very much.

Obviously we have no idea of your server / os / config etc etc as you have no forum signature, but assuming you're in a position to run ALL upgrades meaning: Having complete backups / server snapshot etc just in case, then you could run:

plesk installer --select-release-current --upgrade-installed-components

And re-check those installed versions

 

[Harm Jakob Tolsma]

Unfortunately plesk installer --select-release-current --upgrade-installed-components didnt fix it.

But I managed to fix it by going to Tools & Settings then picking Scheduled Tasks (Cron jobs).
In the list of tasks, I searched for 'node' and then started that task using Run Now.

After checking using plesk ext nodejs --versions, I saw all the updated versions.

Thanks for the help tho!