October 2026 security updates: Next.js, Node.js and PHP in one place

Three of the most common web stacks shipped critical security fixes within one week in October 2026: Next.js on 14 October, then Node.js and PHP on 21 October. If your product runs on more than one of them, this page has every fixed version in one place, a quick check for each, and the order to patch in. Each row links to a full guide with a tested checker script.

Want them patched and checked for you? Next.js, Node.js and Python fixes →

Every fix in one table

Check all three in two minutes

These one-liners answer "am I on a fixed version?". Run them on the machine or container that serves traffic, not only your laptop.

# Next.js: installed versions (need next 16.4.1 / 15.5.28 and sharp 0.35.5+)
npm ls next sharp

# Node.js: prints -17 on patched builds, undefined on unpatched ones
node -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH"

# PHP: the CLI version (also check the PHP your web server runs)
php -v

• Next.js: Next.js 15.5.28 still accepts sharp 0.34, which has no fix, so check sharp separately. The Next.js checker also detects which affected features your app uses.
• Node.js: the Brotli version number does not change with the fix; the zlib constant does. The Node.js checker also finds where your code decodes Brotli from outside.
• PHP: php -v shows the command-line PHP, which can differ from PHP-FPM or mod_php, and Ubuntu fixes keep the old version number. The PHP checker handles both.

All three checkers are open source on GitHub: next-security-check, node-brotli-check and php2shell-check.

What to patch first

1. 1
   Internet-facing PHP on Apache mod_php. PHP demonstrated attacks there that work before any application code runs.
2. 2
   Self-hosted Next.js on Linux that serves images. The image optimizer flaw needs no login, and most sites use next/image.
3. 3
   Express 5 APIs and services that fetch untrusted URLs on an unpatched Node.js. Both pass outside Brotli data to the vulnerable decoder.
4. 4
   Everything else, including staging servers, admin tools and old containers that still run.

If someone else hosts it

• Vercel: rolls out Node.js patch releases itself; your Next.js version is still yours to update and redeploy.
• Docker: pin the fixed tags (for example node:24.22.1-alpine, php:8.4.27-fpm), rebuild and redeploy. Pulling a new image does not change containers that are already running.
• Shared or managed PHP hosting: the host updates PHP, but check the version your site actually runs through the web.

Dates coming next

Common questions

Want all of it patched for you?

I update Next.js apps, Node.js runtimes and PHP servers, fix what the upgrade breaks, and verify the result. See Next.js and Node.js bug fixing and PHP security update and upgrade.