Node.js Security Update

Event timeline

How this incident unfolded, from the official status page.

1. Identified

   2 days ago

   Hostinger

   Our team is aware about the released Node.js version 24.22.1, which fixes 7 security vulnerabilities, several of them high severity. We will be rolling this patched Node.js runtime out to our shared hosting platform so your applications receive these fixes. No actions are required from client side. We'll provide further updates soon. Thank you for your patience.

2. Identified

   2 days ago

   Hostinger

   We're rolling out the Node.js security update (versions 24.22.1 and 22.23.4) across our hosting products: - Agency Hosting: We have deployed a patched version. Your websites are secured, no action is needed from customer's side. - Hostinger AI Builder: the update is ready and being rolled out. Websites will move to the updated version automatically. In the meantime, no action is needed from the customer's side. - Web Hosting and Cloud Hosting: the updated Node.js packages from our operating system vendor are expected within the next few hours, and we'll install them as soon as they're available. Meanwhile, we're deploying additional security rules on our servers to reduce exposure. No action needed yet. VPS clients manage Node.js themselves and can follow our guide: https://www.hostinger.com/blog/securing-nodejs/

3. Monitoring

   1 day ago

   Hostinger

   We have completed the rollout for the Node.js security updates (24.22.1 and 22.23.4) across managed hosting products. Security fixes for Node.js 18 and 20 have also been backported and installed on Web Hosting, Cloud Hosting, and cPanel. No actions are necessary for customers running Agency Hosting, AI Builder, Web Hosting, Cloud Hosting and cPanel Node.js applications. VPS clients manage Node.js themselves and can follow our guide: https://www.hostinger.com/blog/securing-nodejs/