PHP and Node.js security updates
Following the PHP and Node.js vulnerability announcements on October 21, 2026, we assessed the impact on hazBase’s service infrastructure and related websites, and carried out updates and checks appropriate to each environment.
Node.js updates
We updated Node.js in the main APIs, authentication services and developer console to a patched release and verified service startup and responses. Representative SDK usage examples have also been validated with patched Node.js.
PHP usage
The hazBase API, authentication services and management console do not use PHP for their application runtime.
Actions taken
- Node.js: updated the main APIs, authentication services and developer console to a patched release and verified startup and responses
Sources
The Node.js announcement covers security fixes including Brotli, TLS and DNS issues. The PHP advisory addresses two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. See the official announcements below for details.
This article is provided for general information purposes only and is not investment or legal advice. Applicable laws and regulations vary by asset, structure, and jurisdiction; review them for each project.