Node.js Security Update

Incident Report for Hostinger

Update

We're rolling out the Node.js security update (versions 24.22.1 and 22.23.4) across our hosting products:

- Agency Hosting: We have deployed a patched version. Your websites are secured, no action is needed from customer's side.
- Hostinger AI Builder: the update is ready and being rolled out. Websites will move to the updated version automatically. In the meantime, no action is needed from the customer's side.
- Web Hosting and Cloud Hosting: the updated Node.js packages from our operating system vendor are expected within the next few hours, and we'll install them as soon as they're available. Meanwhile, we're deploying additional security rules on our servers to reduce exposure. No action needed yet.

VPS clients manage Node.js themselves and can follow our guide: https://www.hostinger.com/blog/securing-nodejs/
Posted Oct 22, 2026 - 10:21 UTC

Identified

Our team is aware about the released Node.js version 24.22.1, which fixes 7 security vulnerabilities, several of them high severity. We will be rolling this patched Node.js runtime out to our shared hosting platform so your applications receive these fixes.

No actions are required from client side. We'll provide further updates soon. Thank you for your patience.
Posted Oct 22, 2026 - 09:28 UTC