On Oct 21, 2026, a critical vulnerability in Node.js (CVE-2026-111497, "Node2Shell") was publicly disclosed. It allows remote code execution when an application decodes untrusted Brotli-compressed data, and it affected the Node.js version used by some of our background services (real-time messaging, presence, support chat and call-center connections).
Our review found no internet-facing path to the vulnerable code in our setup. As a precaution, we deployed the patched release (Node.js 24.22.1) to all affected services on Oct 23 at 7:35 AM ET and added an extra safeguard. After the rollout we monitored for 60 minutes and saw no service errors, restarts or performance change.
There was no service interruption, and there is no indication that our systems were targeted. No action is required on your part.