All Release Notes
Update your Connect applications to use a patched version of Node.js
23 October 2026
Connect
Announcement
Deployments
Node.js published security releases on 21 October 2026 that fix 10 vulnerabilities, including four high-severity issues. These include a remote code execution vulnerability in the Brotli decoder (CVE-2026-111497), TLS certificate hostname validation bypasses (CVE-2026-105483 and CVE-2026-106069), and a DNS resolution flaw (CVE-2026-105482). For the full list, see the Node.js security release announcement.
Connect applications that run on an earlier Node.js version might be vulnerable. To protect your applications, update to one of the following patched versions that Connect supports:
  • Node.js 24: 24.22.1 or later
  • Node.js 22: 22.23.4 or later

Node.js 20 and earlier are end-of-life and don't receive a fix. If your Connector uses one of these versions, migrate to a supported version.

If you have active Deployments, take the following steps as soon as possible:

  1. Set the Node.js version of your Connector under the key engines in the package.json file to a patched version.
  2. Update your Connector and redeploy your Deployments so they run on the patched version.

Deployments that you don't redeploy continue to run on their current Node.js version.

If you need help or have questions, contact commercetools support.