# This week's Node.js, PHP and GitLab advisories, and OpenRig

2026-10-24 · The OpenRig team

What the Node.js, PHP and GitLab security releases of October 21 mean for OpenRig. Only the Node.js one applies: update Node.

Several security releases landed on October 21, and a few people have asked whether they touch OpenRig. Here is the short answer for each.

## Node.js: yes, update Node

**What it is.** Node.js's [October 21 security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) fixes ten issues. The most serious, CVE-2026-111497, is in the Brotli decoder that ships inside Node: Brotli data crafted by an attacker, when a Node program decompresses it, can corrupt memory and in the worst case run code.

**Does it affect OpenRig?** OpenRig runs on the Node.js you installed (22 or 24) and doesn't ship its own copy, so the fix comes from updating Node. There's no OpenRig release to wait for.

**What to do.** Update Node to 22.23.4 or 24.22.1, or anything newer in the same line. If you use nvm, `nvm install 22` (or `24`) gets the fixed version; then restart the OpenRig daemon so it runs on it:

```bash
node --version
rig daemon stop && rig daemon start
```

If your Node comes from your Linux distribution's packages, check that your distribution has shipped the update; the builds from nodejs.org, nvm and NodeSource have the fix.

We updated Node on our own machines the same day.

## PHP: not affected

**What it is.** PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated request run code on a server running PHP ([PHP's advisory](https://www.php.net/archive/2026.php)).

PHP has since announced a further issue, CVE-2026-115560, with no fix released yet; it says a full advisory comes with its next release.

**Does it affect OpenRig?** No. OpenRig contains no PHP code and doesn't depend on PHP. If you run PHP for something else, update it.

## GitLab and Ruby: not affected

**What it is.** GitLab's [critical patch release](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) (19.5.1, 19.4.3, 19.3.6 and backports to 19.2.9, 19.1.9, 19.0.10 and 18.11.13) fixes CVE-2026-110264, an integer overflow when compiling a crafted regular expression that could let an unauthenticated user run code on a GitLab server. The underlying bugs are in Ruby's regular expression engine, and Ruby 4.0.9, 3.4.12 and 3.3.13 [fix them](https://www.ruby-lang.org/en/news/); Ruby's announcement ties them to four GitLab CVEs, this one included.

**Does it affect OpenRig?** No. OpenRig doesn't use GitLab and contains no Ruby code. If you self-host GitLab, upgrade it; if you run your own Ruby programs, update Ruby.

---

These answers are about OpenRig itself, as of version 0.7.0. Questions are welcome on [GitHub](https://github.com/mvschwarz/openrig/issues).