It’s Not Your Job to Know What Node.js Is

Here's why you're probably fine, and where to check.

Your morning ran like clockwork. You never saw the clock.

You started the car. The map found you a way round the traffic.

You booked the 9:30 before you'd left the driveway.

Your coffee was waiting when you walked in.

Your parcel's in the van, said the text.

Behind plenty of those apps sits a piece of software you've never heard of. It's called Node.js.

You don't need to know what it does. Nobody ever expected you to. That's the deal: technology does its thing, and you run your business.

Last week it got ten security fixes in one go. As of 23 October, nobody had reported them being used in real attacks, though researchers had already shown the serious one working in a lab.

The notice came written by engineers, for engineers, in a language nobody else speaks.

So let's translate.

For most of you, there's nothing to do.

If you use cloud apps like Xero, MYOB, Shopify or Microsoft 365, those companies patch their own servers. That's their job, not yours, and part of what you pay them for every month.

If that's all you use, and nobody built you a website or a tool, you can stop reading here and get back to your day. Honestly.

Unless you've been clever.

These days, plenty of us get AI to build things for us. A booking page over the weekend. A quote calculator. Something that chases invoices while you sleep.

If you only chat with ChatGPT or Copilot, this one doesn't touch you.

But if AI helped you build something, it may well have put Node.js on your own computer, or on the service where your creation now runs. Maybe you clicked through a setup step. Maybe the AI did it for you. Either way, it can stay there long after the project's done.

And unlike Xero, it usually won't keep itself up to date.

Here's the easy bit. Open the same AI that helped you build it, and ask:

"Help me check whether anything I've built uses Node.js, on my computer or online. Check the security notice dated 21 October 2026 at nodejs.org. Before changing anything, explain what needs updating, how it was installed, and how we'll check everything still works afterwards. Only use downloads from nodejs.org. If you can't confirm something, tell me."

The AI can guide you through the check. If it can't confirm what needs changing, pass the same question to whoever looks after your computer or website.

Worth doing this week.

One more group. If someone built your website for you from scratch, rather than on Shopify, Wix or Squarespace, send them one line:

"Does our site, or anything you host for us, use Node.js? If so, is the live version one that was fixed on 21 October or later?"

They'll know what you mean.

That's it.

Here's the thing about those notices. They arrive every week, and the one that matters looks exactly like the forty that don't.

You shouldn't have to keep up with them. We keep an eye on them, and speak up when one is worth your time.

And for members, our people watch the computers you run the business on, every day. Watching isn't updating, though. Anything you've built with AI is yours to check, and now you know the question to ask.

Small business 1, technology 0.

Technology will keep changing. Keeping up is our job. You've got bookings to get back to.

Join from $59 a month

Stay protected, my friends.

The Most Secure Man Alive

For the technically curious: the worst of the ten, CVE-2026-111497, sits in the part of Node.js that unpacks Brotli-compressed data. It could let an attacker run their own code where an affected app unpacks data the attacker controls: something they sent, or a reply the app fetched from their server. Simply having Node.js installed isn't enough, but the other nine fixes cover different problems, so updating is still the right move. The fixed versions are 22.23.4, 24.22.1 and 26.12.1, or a later release of 22, 24 or 26. Version 20 and older, and the short-lived 21, 23 and 25, won't get a fix, so they need replacing.