What the October 2026 Node.js security releases mean for your Vendure store

Every self-hosted Vendure store runs on Node.js. The Vendure server, which answers your API requests, and the Vendure worker, which processes the job queue, are both Node.js processes. That makes the 21 October 2026 Node.js security releases an update for your store too.

Update now. The most serious fix is for CVE-2026-111497, an out-of-bounds write in the Brotli decoder that permits remote code execution. Vendure's API accepts Brotli-compressed request bodies, so an unauthenticated request to your Shop API can reach the vulnerable code. We haven't built an exploit. This is based on the code path. The steps are at the end of this post.

On 21 October 2026 the Node.js project released fixes for all three supported release lines: 22.x, 24.x and 26.x. They close up to 10 vulnerabilities, depending on the release line: 10 on 26.x, 8 on 24.x and 7 on 22.x. Four are rated high, three medium and three low. The releases also update dependencies that ship inside Node.js, including OpenSSL, Undici, c-ares and the CA certificates. The official Node.js advisory lists every issue and the release lines it affects.

How we handle security at Vendure

A store's security depends on every layer it runs on: the Node.js runtime, the packages you install, and Vendure itself. The 21 October fixes are in the runtime, which you update. For the Vendure layer, this is how we work:

• We keep hardening our APIs. We continuously look for opportunities to improve the security of our APIs. For example, our recent v3.8 release introduced support for encrypted-at-rest custom fields, as well as a hardened boundary between sessions created for the Shop and Admin APIs. The 3.8 release post has the details.
• Anyone can report a vulnerability privately. Reports go through GitHub private vulnerability reporting, so we can fix the issue before any details go public.
• Fixes ship as patch releases. Security fixes are released as patch versions of the latest 3.x minor. If you stay on that minor, taking a security fix is a patch update.
• Advisories are public. We publish security advisories on GitHub, so you can see what was affected and which version fixes it.
• The release pipeline is protected too. How Vendure keeps Shai-Hulud out of your stack explains how we publish our npm packages so that no single failure can ship a malicious release.

To hear about Vendure security fixes as they ship, watch releases on the Vendure GitHub repository.

Update the Vendure server and worker

Vendure supports Node.js 22, 24 and 26. Node.js 20 reached end of life on 30 April 2026 and gets no fix. The Vendure installation guide lists the full requirements.

1. Check which Node.js line you are on. Open your Dockerfile and check the FROM line. Projects created with @vendure/create start from node:24. The Docker guide uses node:22-bookworm-slim. If yours says node:20, move to 22 or 24 first.
2. Pick the patched version for your line. That is v22.23.4 for Node.js 22, v24.22.1 for Node.js 24, or v26.12.1 for Node.js 26.
3. Rebuild your image with a fresh base image. Both our Dockerfiles use floating major tags, so the patched version comes from rebuilding with a fresh base image. A plain docker build reuses the cached old base layer and quietly changes nothing, so run docker build --pull . (or --no-cache). Pinning to node:24.22.1 or node:22.23.4-bookworm-slim is fine, but pinned tags then need bumping by hand for every future release. If you run Node.js without Docker, through nvm, a system package or a platform buildpack, install the patched version there and restart the server and the worker.
4. Redeploy the server and the worker. Then run node -v wherever they run, for example with docker exec <container> node -v, to confirm the patched version.

We are building Vendure Cloud with the same care. It opens as a closed beta for paid plans, with general availability planned for Q1 2027.