Back to Security Advisories

EasyApache 4 25.92 — cPanel & WHM Update

EasyApache 4 release 25.92 (October 21, 2026) updates ea-nodejs22 to 22.23.4, fixing seven Node.js vulnerabilities — including CVE-2026-111497, now rated CRITICAL 9.2 by NVD: a buffer overflow in the bundled Google Brotli decoder (versions 1.0.3–1.2.0) that a crafted Brotli stream can turn into memory disclosure, denial of service, or potentially arbitrary code execution. The other named flaws are CVE-2026-105482 (DNS hostname NUL-byte truncation) and CVE-2026-106069 (TLS hostname-verification bypass via non-canonical IPv4 literals). If you host Node.js applications on EasyApache 4, take this update with the same urgency as 25.91.

Critical 9.2 CVSS Actively exploited
cPanel

Affected Versions

25.92

What this means under a SharedLicense license

The Brotli flaw sits in the decompressor Node bundles: any application accepting Brotli-compressed input can be driven into memory disclosure or crashes by a crafted stream, while the DNS and TLS flaws enable hostname confusion that can defeat name-based security checks.

EasyApache 4 25.92

2026 October 21

Security and maintenance updates

We released updated packages for EasyApache 4.

This security release updates ea-nodejs22 to 22.23.4, which fixes seven vulnerabilities, including CVE-2026-111497, CVE-2026-105482 and CVE-2026-106069 (high). It also rebuilds the ea-php74, ea-php80 and ea-php81 meta packages so their change log lists the CVE-2026-109618 and CVE-2026-109619 backport.

The ea-tomcat101 change log now lists the six CVEs fixed in Tomcat 10.1.61, which shipped in EasyApache 4 25.90.

For a full list of changes, read the EasyApache 4 change log.

Frequently Asked Questions

What does EasyApache 4 25.92 fix?
Seven Node.js vulnerabilities via ea-nodejs22 22.23.4 — most notably CVE-2026-111497, a buffer overflow in the bundled Brotli decoder that NVD rates Critical 9.2, plus CVE-2026-105482 (DNS NUL-byte truncation in dns.resolve*/dns.reverse, an incomplete fix follow-up to CVE-2026-48930) and CVE-2026-106069 (TLS certificate validated against the wrong IP for non-canonical IPv4 literals). It also rebuilds the ea-php74, ea-php80 and ea-php81 meta packages to list the CVE-2026-109618 and CVE-2026-109619 PHP2Shell backport, and updates the ea-tomcat101 change log for the six CVEs fixed in Tomcat 10.1.61.
What is CVE-2026-111497 (the Brotli flaw)?
It is a buffer overflow in Google Brotli's decoder (c/dec/decode.c) affecting Brotli 1.0.3 through 1.2.0 on all platforms. A remote unauthenticated attacker can send a crafted Brotli-compressed stream to corrupt adjacent decoder memory, disclose sensitive memory contents, cause denial of service, or potentially execute arbitrary code. NVD rates it Critical 9.2 (CVSS v4.0); the fix is Brotli 1.0.10 / 1.1.1, which Node bundles in 22.23.4.
Do I need 25.92 if I already installed 25.91?
Yes if you host Node.js applications — 25.92 (October 21, 2026) carries the Node.js 22.23.4 fixes that 25.91 does not, including the Critical Brotli decoder flaw. The PHP meta-package rebuild in 25.92 is documentation-only: the actual CVE-2026-109618 and CVE-2026-109619 PHP2Shell fixes ride in 25.91.
How do I update, and what else uses Brotli?
Run yum update 'ea-*' or use WHM → EasyApache 4 → Update, confirm ea-nodejs22 reports 22.23.4 or later, and restart your Node.js applications so they run the patched runtime. Note the Brotli flaw is in the shared library, not Node alone — any application linking a Brotli decoder in the 1.0.3–1.2.0 range should update that library too (fixed in Brotli 1.0.10 / 1.1.1).

References

Security Advisories

Related Advisories

ConfigServer Security & Firewall (CSF) 16.35-1 — cPanel & WHM Update

2026-11-09

ConfigServer Security & Firewall (CSF) 16.34-1 — cPanel & WHM Update

2026-11-02

PHP Security Release – CVE-2026-115560

2026-10-24

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System