Node.js Security Update for Medusa Stores: A Simple Update, Not a Migration

If your store runs on Medusa, it runs on Node.js, and Node.js released security fixes on 21 October 2026. For your store, this means updating Node.js to a newer version and redeploying. It does not mean upgrading Medusa, changing your code or touching your data.

This guide explains what changed in plain terms, how to confirm your store is covered and what to tell your tech team. If you also run stores on PHP platforms, the PHP security alert from the same day is a separate issue, covered in our PHP guide.

What we know so far

Updated 22 October 2026

• What: Node.js released security fixes for its supported versions (22, 24 and 26). The most serious issues are rated High.
• Who is affected: any app running on Node.js that has not been updated yet, including Medusa backends and Next.js storefronts.
• What has to happen: Node.js moves to 22.23.4, 24.22.1 or 26.12.1 (or newer), followed by a redeploy.
• Attacks: the official Node.js advisory does not report attacks in the wild. Vercel notes that researchers demonstrated working attacks on unpatched versions in a lab, so the update should not wait.
• Medusa: no Medusa upgrade is needed. Every Medusa 2.x version supports the updated Node.js.
• The one thing to check: whether anything still runs on Node.js 20 or 25. Both are no longer supported and will not get these fixes.

What happened, in plain terms

Think of your store as two layers. Medusa is the commerce application: products, carts, orders, payments. Node.js is the engine that runs it, in the same way an operating system runs an app on your laptop.

On 21 October 2026, the Node.js project released security fixes for that engine. The fixes are in Node.js itself, not in Medusa. That is why the solution is to update the engine, while the application on top stays as it is.

What was fixed

The Node.js team published the full list openly. In plain terms, the most important fixes cover:

• Compressed data: specially crafted Brotli-compressed data from outside could make Node.js run code it should not.
• Secure connections: two ways to make Node.js trust the wrong server when it connects to another service, such as a payment provider or an ERP.
• Address lookups: a way to make Node.js look up the wrong address.

There are also several smaller fixes, plus an updated list of trusted security certificates. Your tech team will find the technical details in the cheatsheet below.

What it means for a store

For a typical online store, these fixes matter most for the connections your store makes to other systems: payments, ERP, shipping and search. They protect your store from being tricked by a fake server on the way.

Nothing in this release changes how Medusa works. Your products, orders, customer data, modules and integrations stay as they are. The update swaps the engine underneath for a safer version of the same engine.

Why this is a simple update

Node.js versions have three parts, for example 24.22.1. The first number is the major version, the line your project is built for. The rest marks smaller updates within that line.

This security release stays within each line. A project on Node.js 24 stays on 24 and moves to 24.22.1, a project on 22 moves to 22.23.4, and a project on 26 moves to 26.12.1.

Updates within the same line are designed to keep existing code working, so there are no migration steps for your store. In practice, your team changes one version number, rebuilds and redeploys.

One thing deserves a quick check after the deploy: this release makes certificate checks stricter and updates the list of trusted certificates. Integrations such as payments, ERP and shipping should keep working, and it is worth confirming that they do.

The only bigger step is for projects still on Node.js 20 or 25, which have no fix and have to move to a supported line (more on that below).

Medusa is already on the right path

Medusa keeps its projects on supported Node.js versions. Medusa 2.22, released on the same day, requires Node.js 22.22.0 or newer and moves projects off Node.js 20, which reached its end of life in April. Projects on a current Medusa version are already on a supported line and only need the latest update within it.

Older Medusa 2.x versions support Node.js 22 and 24 as well. No Medusa 2.x version blocks you from installing the updated Node.js, so no store has to upgrade Medusa first.

Is your store affected?

Every Node.js app is affected until its Node.js version is updated. How much you need to do depends on your Node.js version and where your store runs.

Your Medusa backend

Source: the supported Node.js versions published with each Medusa release on npm.

Your Next.js storefront

The storefront runs on Node.js too, so it gets the same update. Medusa's installation guide recommends Node.js 24 or lower for its Next.js starter storefront, so 24.22.1 is the right choice there. If your storefront is on Vercel or Medusa Cloud, most of the work is done for you (see below).

Where your store is hosted

• Medusa Cloud: Medusa Cloud lets you choose the Node.js version for your backend through the engines field in package.json. If that field is missing, it uses Node.js 20, so make sure your project sets it, for example "node": ">=24.22.1", and redeploy. Storefronts on Medusa Cloud are built on Node.js 24.
• Vercel: Vercel blocked the main attack path for every project on its network on 21 October and is rolling out the updated Node.js automatically for projects on Node.js 22 and 24. Projects still set to Node.js 20 need to switch to 24 and redeploy.
• Your own servers, containers or another host: your team or host updates Node.js. The update takes effect once the app is rebuilt and redeployed.

Node.js 20 and 25 are the ones to act on

Node.js 20 reached its end of life on 30 April 2026 and Node.js 25 on 1 June 2026. The Node.js project says that end-of-life versions are always affected by a security release, and this one includes no fix for either.

If you ask your team only one question this week, ask whether anything still runs on Node.js 20 or 25. Moving to 24 is a bigger step than an update within a line, so your team should test the store before going live. It still does not require a Medusa upgrade, and Medusa 2.x supports Node.js 24.

What to do right now

Node.js runs on the server, so nobody changes it from the Medusa admin. Your job is to get a clear answer from the people who run your store. It takes three steps.

1. Send this to whoever runs your store

That means your developers, your agency or your hosting provider. Often it is more than one of them, for example a storefront on Vercel and a backend somewhere else.

2. Ask three questions, and get the answers in writing

• Which Node.js version do our backend and storefront run, including staging?
• Have they been updated to the 21 October 2026 security release and redeployed?
• Does anything still run on Node.js 20 or 25?

Written answers are useful later. They show what was done and when.

3. Make the next update automatic

Ask your team to set up builds so that each deploy picks up the latest Node.js update in your line. Then future security releases arrive with a normal deploy, with nobody having to remember them.

Cheatsheet for your tech team

This part is for the people who will make the change. If you forward the article, point them here.

Find the Node.js version

• Run node -v where the app runs (the server or container that serves traffic, not a laptop).
• Vercel: Project Settings > Build and Deployment > Node.js Version.
• Medusa Cloud: engines.node in package.json (no field means Node.js 20).
• In the repository: the base image in the Dockerfile (FROM node:...), .nvmrc, engines.node in package.json and node-version in CI.

Which version to install

Dates from the Node.js release schedule.

Update, rebuild, redeploy

• Pin the major line, for example node:24 in the Dockerfile and 24 in .nvmrc and CI, and make sure builds fetch the latest image or binary:
• Docker: build with --pull, or without cache, so a cached old node:24 image is not reused.
• GitHub Actions: set check-latest: true in actions/setup-node.
• Medusa Cloud: set engines.node in package.json.
• Redeploy the backend and the storefront. The redeploy is what actually swaps the runtime.
• After the deploy, check outgoing integrations (payments, ERP, shipping), because certificate checks are stricter in this release. No code changes or database migrations are needed.

Notes for Medusa projects

• Medusa 2.x uses Express 4, whose request parser does not decompress Brotli request bodies. The Brotli issue is therefore not reachable through incoming API requests by default. Outgoing fetch calls do decompress responses, so the update still matters for integrations. Custom code that decompresses incoming data should be checked too.
• If you self-host a Next.js storefront, update Node.js there as well. Vercel notes that Next.js image optimization does not block Brotli responses.
• Vercel's firewall rule only covers traffic that goes through Vercel. A Medusa backend hosted elsewhere is called directly by browsers, the admin and payment webhooks, so it needs its own Node.js update. Do not restrict it to storefront traffic only, as that would break the store.
• Medusa 2.22 and newer require Node.js 22.22.0 or newer. Choose the latest update of 22 or 24 to stay covered.

Full list of fixes

From the Node.js advisory:

• High: Brotli decoder out-of-bounds write (CVE-2026-111497); TLS hostname check bypasses (CVE-2026-106069, and CVE-2026-105483 on 24 and 26); dns.resolve truncating names that contain a NUL character (CVE-2026-105482).
• Medium: keep-alive socket response handling (CVE-2026-105481); certificate validation for non-canonical IPv4 hostnames (CVE-2026-106072); repeated crypto.randomUUID() values in startup snapshots and single executable apps (CVE-2026-106074).
• Low: Permission Model and ZipFile issues (CVE-2026-106070, CVE-2026-106071, CVE-2026-106073).
• Dependency updates: c-ares, OpenSSL, SQLite, Undici and the trusted certificate bundle (after an eMudhra intermediate certificate authority was compromised).

Why updates like this are routine

Node.js publishes security releases several times a year, and each supported version line gets the fixes at the same time. That predictability is a strength: teams know what to expect and can plan for it.

A store stays covered with three habits:

• Stay on a supported line. Today that means Node.js 22 or 24, with 24 giving the longest runway.
• Let builds pick up the latest update in your line. The next fix then arrives with a normal deploy.
• Deploy regularly. A store that ships every week or two picks up security fixes without a separate project.

Plan one step ahead too. Node.js 22 support ends on 30 April 2027, and Node.js 26 becomes the next long-term support version on 28 October 2026.

How we handled it at Rigby

Since 21 October, we have been moving every Medusa project we build and maintain to the updated Node.js release. So far, none has needed a Medusa upgrade or code changes. We are also setting up each project so that builds pick up future Node.js updates automatically.

If you run a Medusa store and are not sure where you stand, our team can check it with you.

The short version

If your store runs on Medusa or a Next.js storefront, it runs on Node.js. Update Node.js to 22.23.4 or 24.22.1 and redeploy. You do not need to upgrade Medusa or change your code.

If anything still runs on Node.js 20 or 25, move it to 24 this week. On Medusa Cloud, make sure package.json sets the Node.js version.

FAQ on the Node.js security update

Do I need to update Medusa?

No. The fixes are in Node.js, the engine Medusa runs on. Every Medusa 2.x version supports the updated Node.js, so your Medusa version can stay as it is.

Will the update break anything in my store?

It should not, if you stay on your current Node.js line. Updates within a line are designed to keep existing code working. This release makes certificate checks stricter, so check your payment, ERP and shipping integrations after the deploy. Moving off Node.js 20 or 25 is a bigger step and deserves a proper test first.

My store is on Medusa Cloud. Do I need to do anything?

Check that package.json sets the Node.js version. Without an engines field, Medusa Cloud uses Node.js 20, which gets no fix. Set it to 24 and redeploy.

My store is on Vercel. Do I need to do anything?

Only if your project is set to Node.js 20. Vercel blocked the main attack path on 21 October and is rolling out the updated versions for projects on Node.js 22 and 24. Projects on Node.js 20 need to switch to 24 and redeploy.

How urgent is this?

Do it this week. The issues are rated High, and researchers have shown working attacks in a lab, although the official advisory reports none in the wild. The fix itself is a version change plus a redeploy. Anything on Node.js 20 or 25 comes first.

Do we need to change passwords or API keys?

Not because of this update, unless your team finds signs of a break-in. It fixes flaws in Node.js itself. If logs show something unusual, treat it as an incident and rotate keys then.

Should we move to Node.js 26?

Not for a Medusa store today. Medusa recommends Node.js 24 or lower for its Next.js starter storefront, and Medusa Cloud builds storefronts on Node.js 24. Node.js 24 is supported until April 2028.

Sources

• Node.js, October 2026 security releases
• Node.js, Release schedule
• Vercel, Node.js security advisory
• Medusa, Release v2.22.0
• Medusa, Installation
• Medusa Cloud, Prerequisites
• npm, @medusajs/medusa