# Check Node.js and Ruby security updates

> Compare the runtime serving your application with the Node.js and Ruby October security advisories.

Source: https://fullbytedeveloper.com/blog/node-ruby-october-security-updates
Originally posted: 2026-10-23
Published here: 2026-11-06

Node.js and Ruby published October security fixes for different input-processing bugs. Check the runtime used by your deployed application, including container images and background workers, before deciding the machine is patched.

## Check the Node.js release line

The Node.js advisory lists fixes in 22.23.4, 24.22.1 and 26.12.1. It includes the Brotli decoder vulnerability CVE-2026-111497 alongside other fixes. Use a current patched release on a supported line and compare any vendor-maintained package with that vendor's notice. [1]

## Check Ruby pattern compilation

Ruby's advisory recommends 4.0.9, 3.4.12 or 3.3.13 or later. It explains that these bugs require compiling a regular expression from attacker-controlled text; ordinary developer-written patterns are not affected. [2]

A regex timeout does not prevent these compilation bugs. If an upgrade is temporarily unavailable, Ruby recommends avoiding compilation of untrusted patterns. [2]

After updating, restart the application processes and confirm which runtime they loaded. Keep that deployed version in your update record, rather than relying only on the version your terminal finds.

## Sources

1. [Node.js October security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
2. [Ruby regular expression compilation fixes](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/)

## Original posts

- [Instagram post](https://www.instagram.com/fullbytedeveloper/p/De12gYfDj4R/)