Back to Security Advisories

EasyApache 4 25.92 — cPanel & WHM Update

EasyApache 4 release 25.92 (October 21, 2026) updates ea-nodejs22 to 22.23.4, fixing seven Node.js vulnerabilities including three rated high (CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069), and rebuilds the ea-php74, ea-php80 and ea-php81 meta packages so their change logs list the CVE-2026-109618 and CVE-2026-109619 backport. The aggregate release CVSS is 9.2 — if you run Node.js apps on EasyApache 4, take this update with the same urgency as 25.91.

Critical 9.2 CVSS
cPanel

Affected Versions

25.92

What this means under a SharedLicense license

The high-severity Node.js flaws run in the ea-nodejs22 runtime serving application traffic directly, and the meta-package rebuild documents that the critical PHP fixes from 25.91 also cover the legacy PHP 7.4/8.0/8.1 branches.

EasyApache 4 25.92

2026 October 21

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release updates ea-nodejs22 to 22.23.4, which fixes seven vulnerabilities, including CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069 (high). It also rebuilds the ea-php74, ea-php80 and ea-php81 meta packages so their change log lists the CVE-2026-109618 and CVE-2026-109619 backport.

The ea-tomcat101 change log now lists the six CVEs fixed in Tomcat 10.1.61, which shipped in EasyApache 4 25.90.

For a full list of changes, read the EasyApache 4 change log.

Frequently Asked Questions

What does EasyApache 4 25.92 fix?
Seven Node.js vulnerabilities via ea-nodejs22 22.23.4 — three of them high: CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069. It also rebuilds the ea-php74, ea-php80 and ea-php81 meta packages to list the CVE-2026-109618 and CVE-2026-109619 backport, and updates the ea-tomcat101 change log to document the six CVEs fixed in Tomcat 10.1.61.
Do I need 25.92 if I already installed 25.91?
Yes if you host Node.js applications — 25.92 (October 21, 2026) carries the Node.js 22.23.4 fixes that 25.91 does not. The PHP meta-package rebuild in 25.92 is documentation-only: the actual CVE-2026-109618 and CVE-2026-109619 fixes ride in 25.91.
How do I update?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update, then confirm ea-nodejs22 reports 22.23.4 or later and restart your Node.js applications so they run the patched runtime.
Which CVEs affect Node.js specifically?
CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069 are the three rated high among the seven fixed in Node.js 22.23.4; the release note lists them by name. The remaining four Node.js CVE IDs live in the full change log linked from the release.

References

Security Advisories

Related Advisories

EasyApache 4 25.91 — cPanel & WHM Update

2026-10-21

cPanel CVE-2026-110672

2026-10-19 00:00:00

cPanel CVE-2026-110673

2026-10-19 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System