Skip to main content
Published: 22 October 2026 · Status: Not affected Depict is not affected by the ten Node.js vulnerabilities published on 21 October 2026.

​
What happened

The Node.js project released security updates for versions 22, 24 and 26. The ten fixes cover hostname checks in the DNS and TLS modules, a memory bug in the Brotli decompressor, the HTTP keep-alive agent, the permission model and the random number cache used by startup snapshots. The release also updates the bundled OpenSSL and removes a compromised certificate authority from the trust store. Each vulnerability needs a specific condition to be exploitable: an application that resolves attacker-supplied hostnames, decompresses attacker-supplied Brotli data, connects to servers by numeric IP address, or runs with the permission model or a startup snapshot.

​
Why Depict is not affected

Depict’s apps and APIs run on Cloudflare Workers, which is not Node.js and does not contain the affected code. The small number of Depict services that run Node.js do not resolve, decompress or connect to data supplied by third parties, so none of the conditions needed to exploit these issues are present. The Depict storefront code runs in the shopper’s browser and does not involve Node.js at all.

​
What merchants need to do

Nothing for Depict. You don’t need to update the app, change any code or rotate credentials or access tokens. If other vendors in your stack run Node.js servers, check their advisories separately. If you need a written confirmation for your security records, contact support@depict.ai.