Node.js security vulnerabilities announced, but no Plesk update is available

Vincent Lauton

Updated October 21, 2026 20:06

kb: technical ext: nodejs

Applicable to

Plesk for Linux

Symptoms

The Node.js project has announced a security release (for example, the October 2026 security releases) that fixes vulnerabilities in the 26.x, 24.x and 22.x lines.
No corresponding Plesk update or announcement is available yet.
A vulnerability scanner or security advisory reports that the Node.js version on the server is affected.

Cause

Node.js is not shipped with Plesk updates. The Node.js extension downloads Node.js releases directly from the Node.js project, so there is no Plesk update to publish for a Node.js security release.

The extension checks for new Node.js releases once a day as part of Plesk's maintenance tasks. A server may therefore run a vulnerable build for up to a day after the Node.js project publishes a release.

Resolution

Wait for the automatic update

The daily maintenance task installs the fixed Node.js builds without any manual action. The installed versions can be checked after the next maintenance run.

Update Node.js manually

Connect to the server via SSH
Trigger the update:

# plesk php -dauto_prepend_file=sdk.php '/opt/psa/admin/plib/modules/nodejs/scripts/nodejs-auto-update.php'
When the command finishes, check the installed versions in Plesk under Tools & Settings > Node.js, or from the command line.

Confirm the fix

The installed versions should be compared with the fixed versions listed in the official Node.js announcement. For the October 2026 security releases, the fixed builds are:

Node.js line	Fixed version
26.x	26.12.1
24.x	24.22.1
22.x	22.23.4

After the update, any Node.js applications running under Plesk should be restarted so that the patched runtime is used.

Additional information

Node.js security announcement (October 2026): https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
The announcement lists each CVE with its severity and the affected release lines.
If the update does not install the fixed version, Plesk Technical Support can be contacted. The output of the update command should be included in the request.