Investigation and Response Regarding Node.js Security Vulnerabilities
Status: Remediation in Progress
Published: October 22, 2026
Last Updated: October 22, 2026
Event Overview
On October 21, 2026, the Node.js project released security updates addressing multiple vulnerabilities in the Node.js 22.x, 24.x, and 26.x release lines.
Under certain conditions, these vulnerabilities may lead to remote code execution, TLS certificate validation bypass, service disruption, or other security risks.
Impact on Notta
Notta has completed an initial inventory of Node.js runtimes and related components in its production environment.
Our review identified one server-side service and certain edge computing components that use Node.js versions requiring an update. The relevant upgrades and validation are in progress.
Some web projects use Node.js only during the build process. The artifacts delivered to users’ browsers are static front-end resources, and Node.js does not run in the browser. These projects are therefore not directly affected by the Node.js runtime vulnerabilities addressed in this release.
As a preventive measure, Notta will also update the build environments for the relevant web projects and rebuild and release the projects using the patched environments.
Notta services are currently operating normally. As of the last update to this notice, we have found no indication of abnormal activity related to these vulnerabilities.
Impact on Customer Data and Accounts
As of the last update to this notice, we have found no indication of abnormal activity involving customer data or accounts related to exploitation of these vulnerabilities.
Notta is continuing its review of relevant service logs, security alerts, and access activity. This assessment will be updated as the upgrade, validation, and security review progress.
Notta’s Response
Notta is implementing the following measures:
Upgrading and redeploying the server-side service and edge computing components that run Node.js;
Updating the build environments for the relevant web projects, followed by rebuilding and releasing them using the patched environments;
Distinguishing application-managed dependencies from cloud-provider-managed runtimes and continuing to track security updates from the relevant cloud providers;
Performing functional regression, compatibility, and security validation after the upgrades;
Reviewing relevant service logs and security alerts and continuing to monitor for abnormal activity potentially related to exploitation of these vulnerabilities.
We will update the status of this notice after the relevant components have been upgraded and validated.
Actions Required by Customers
No customer action is required in response to this event at this time. Customers may continue to use Notta services as normal.
If our continuing review identifies any required customer action, we will provide details promptly through this page and the appropriate customer communication channels.
Further Updates and Support
Notta will update this notice after the relevant components have been upgraded and validated. If the affected scope, risks to customer data or accounts, or required customer actions change before then, we will provide an update promptly.
For further questions, please contact us through your usual Notta customer support or business contact channel.
Reference Information
Revision History
October 22, 2026: Initial publication. The initial scope assessment was completed, and component upgrades, validation, and security review are in progress.
