🚨 PHP and Node.js Patch Critical Vulnerabilities: What to Check Today
Published on October 21, 2026 by Nayib Sarmiento
Today, October 21, 2026, PHP and Node.js shipped security updates on the same day. PHP's are critical (unauthenticated remote code execution), and Node.js includes high-severity issues in TLS and the Brotli decoder. If you run sites or APIs on either, this affects you.
Here's what matters, straight to the point.
🐘 PHP: two critical bugs (CVSS 9.2)
| CVE | What happens | Where it's proven |
|---|---|---|
| CVE-2026-109618 | When PHP runs out of memory, request cleanup can touch half-initialized memory. Triggered by crafted multipart requests. |
Apache mod_php, default configuration, before your code even runs |
| CVE-2026-109619 | Global state survives between requests and points to freed memory (use-after-free). | mod_php and PHP-FPM, via session.upload_progress (on by default) |
Fixed versions: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
🟩 Node.js: 4 high, 3 medium, 3 low
Fixed versions: v26.12.1, v24.22.1 (LTS), and v22.23.4.
| CVE | Severity | Affected lines | What happens |
|---|---|---|---|
| CVE-2026-111497 | High | 26, 24, 22 | Out-of-bounds write in the Brotli decoder (possible remote code execution) |
| CVE-2026-105482 | High | 26, 24, 22 | dns.resolve truncates names containing a NUL character |
| CVE-2026-105483 | High | 26, 24 | TLS hostname validation bypass with IPs written in full-width digits |
| CVE-2026-106069 | High | 26, 24, 22 | TLS hostname validation bypass when the host loosely resolves to an IP |
| CVE-2026-105481 | Medium | 26, 24, 22 | Keep-alive socket processes a response written before the request was sent |
| CVE-2026-106072 | Medium | 26, 24, 22 | Improper certificate validation for non-canonical IPv4: DNS SANs authenticate IP endpoints |
| CVE-2026-106074 | Medium | 26, 24, 22 | crypto.randomUUID() and randomInt() repeat values in startup snapshots and SEAs |
| CVE-2026-106070 | Low | 26 | ZipFile returns attacker-controlled bytes after failed ZIP header validation |
| CVE-2026-106071 | Low | 26 | Permission Model filesystem over-grant via wildcard lookup |
| CVE-2026-106073 | Low | 26, 24, 22 | Permission Model bypass with fs.realpathSync |
Dependency updates: OpenSSL, undici, c-ares, SQLite, and root certificates (compromised eMudhra intermediate CA).
⚠️ Node 20 and other end-of-life lines are also vulnerable and don't get the fix. If you still have node:20 in a Dockerfile or node-version: "20" in CI, it's time to move to 24.