Security Advisory: Node.js Security Vulnerabilities (Vulnerabilities (Updated October 27, 2026)

Executive Summary

Optimizely is actively addressing the recent security vulnerabilities disclosed by the Node.js organization affecting Node.js release lines 22.x, 24.x, and 26.x. Upon disclosure, Optimizely Engineering and Security teams immediately initiated a comprehensive review across all products and internal infrastructure. Affected services have been identified and are currently undergoing patching and redeployment, with several product lines already fully remediated.

There is no evidence of exploitation across any Optimizely product or customer environment.

What Happened

Last week, the Node.js organization disclosed multiple security vulnerabilities and released patched versions across the 22.x, 24.x, and 26.x release lines. Because Node.js is utilized across various Optimizely services, tooling, and customer-hosted applications, Optimizely initiated a platform-wide assessment to identify and remediate any impacted components.

What We Are Doing

Optimizely Engineering began reviewing all product lines and supporting infrastructure on October 22, 2026, at 12:12 UTC.

· All components requiring updates have been identified and prioritized for remediation.

· Remaining code updates and redeployments are actively underway and scheduled for completion this week.

· Our teams continue to monitor and investigate across all product lines until 100% remediation coverage is verified.

Protections in Place & Customer Actions Required

Optimizely maintains defense-in-depth security controls, continuous monitoring, and automated container build pipelines to protect customer environments. We believe the risk of exploiting the Brotli overflow bug is very low on the Optimizley platform due to least privilege architecture, however we are treating this as a High CVE vulnerability.

For most Optimizely SaaS solutions, updates are managed and deployed automatically by Optimizely with no customer intervention needed. However, specific customer actions are required for CMS (PaaS/DXP), Commerce Connect, and Configured Commerce:

Important Action for CMS & Commerce Connect Customers

For customers hosted on Optimizely DXP, our build pipeline automatically pulls the latest available patched version of Node.js (for your selected major version) whenever a container image is built.

· Who is impacted: Customers who proxy Node.js processes through their .NET application, and customers using Optimizely Frontend Hosting on DXP.

· Required Action: You must trigger a container image rebuild by deploying a code package with a new name or version number. This package can contain the exact same code currently running in production, but it must be uploaded as a new code package not previously deployed on DXP in order to force a fresh container build and apply the patched Node.js version.

· Note on end-of-life Node.js versions: Node.js 18 and 20 are end-of-life and no longer receive security patches from the Node.js project. Customers running these versions should upgrade to a supported major version (Node.js 22 or 24) before redeploying.

Important Action for Configured Commerce Customers

· Required Action: Customers must update and redeploy their instances/applications using the newly released patched versions: 5.2.2610.487+sts or 5.2.2608.730+lts.

Evidence of Exploit

Optimizely Security and Engineering teams have continuously monitored our environments throughout this investigation. We have found zero evidence of any exploitation related to these vulnerabilities across any Optimizely product or service.

How to Contact Us

If you have any questions regarding this advisory or need assistance with redeploying your environment, please reach out to your Customer Success Manager (CSM) or contact Optimizely Support at support@optimizely.com.

Optimizely Desktop note:

The Desktop application for Optimizely (Optimizely Experimentation app) will be deprecated December 31st, 2026. We will not be updating this component for vulnerabilities. Customers should use the new Visual Editor which overcomes the security concerns of the older iFrame based editor.