This week's Node.js, PHP and GitLab advisories, and OpenRig
By The OpenRig team
What the Node.js, PHP and GitLab security releases of October 21 mean for OpenRig. Only the Node.js one applies: update Node.
Several security releases landed on October 21, and a few people have asked whether they touch OpenRig. Here is the short answer for each.
Node.js: yes, update Node
What it is. Node.js's October 21 security release fixes ten issues. The most serious, CVE-2026-111497, is in the Brotli decoder that ships inside Node: Brotli data crafted by an attacker, when a Node program decompresses it, can corrupt memory and in the worst case run code.
Does it affect OpenRig? OpenRig runs on the Node.js you installed (22 or 24) and doesn't ship its own copy, so the fix comes from updating Node. There's no OpenRig release to wait for.
What to do. Update Node to 22.23.4 or 24.22.1, or anything newer in the same line. If you use nvm, nvm install 22 (or 24) gets the fixed version; then restart the OpenRig daemon so it runs on it:
node --version
rig daemon stop && rig daemon start
If your Node comes from your Linux distribution's packages, check that your distribution has shipped the update; the builds from nodejs.org, nvm and NodeSource have the fix.
We updated Node on our own machines the same day.
PHP: not affected
What it is. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated request run code on a server running PHP (PHP's advisory).
PHP has since announced a further issue, CVE-2026-115560, with no fix released yet; it says a full advisory comes with its next release.
Does it affect OpenRig? No. OpenRig contains no PHP code and doesn't depend on PHP. If you run PHP for something else, update it.
GitLab and Ruby: not affected
What it is. GitLab's critical patch release (19.5.1, 19.4.3, 19.3.6 and backports to 19.2.9, 19.1.9, 19.0.10 and 18.11.13) fixes CVE-2026-110264, an integer overflow when compiling a crafted regular expression that could let an unauthenticated user run code on a GitLab server. The underlying bugs are in Ruby's regular expression engine, and Ruby 4.0.9, 3.4.12 and 3.3.13 fix them; Ruby's announcement ties them to four GitLab CVEs, this one included.
Does it affect OpenRig? No. OpenRig doesn't use GitLab and contains no Ruby code. If you self-host GitLab, upgrade it; if you run your own Ruby programs, update Ruby.
These answers are about OpenRig itself, as of version 0.7.0. Questions are welcome on GitHub.