SOLO Server and the Protection PLUS 5 SDK are not affected by the October 2026 Node.js vulnerabilities (CVE-2026-111497, Node2Shell)
SOLO Server and the SoftwareKey licensing clients are not affected by the 10 vulnerabilities fixed in the Node.js security release of October 21, 2026, including the Brotli remote code execution flaw CVE-2026-111497 (also called Node2Shell). SOLO Server, the Protection PLUS 5 SDK (PLUSManaged and PLUSNative), and Instant Protection PLUS 3 do not include or run on Node.js, and none of them decompress Brotli data. There is nothing to patch and no action is needed for your SOLO Server account or your protected applications.
What did the October 2026 Node.js security release fix?
On October 21, 2026, the Node.js project released Node.js 22.23.4, 24.22.1, and 26.12.1 to fix 10 vulnerabilities in the Node.js runtime. The most serious Node.js vulnerability, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can crash an application, disclose memory, or allow remote code execution when the application decompresses untrusted Brotli data.
The other nine Node.js vulnerabilities affect DNS lookups (CVE-2026-105482), TLS certificate hostname checks (CVE-2026-105483, CVE-2026-106069, and CVE-2026-106072), HTTP keep-alive connections (CVE-2026-105481), random values in startup snapshots (CVE-2026-106074), ZIP file handling (CVE-2026-106070), and the experimental Permission Model (CVE-2026-106071 and CVE-2026-106073). Only software that runs on Node.js is exposed to these nine vulnerabilities. Node.js 20 and older versions are end of life and do not receive the fixes. Details are in the Node.js October 2026 security release advisory.
Why is SOLO Server not affected by the Node.js vulnerabilities?
SOLO Server is built on Microsoft ASP.NET and runs on Windows Server, Microsoft IIS, and Microsoft SQL Server, as listed in the SOLO Server System Requirements. SOLO Server does not include, use, or require Node.js. This applies to every way you can use SOLO Server: the Shared URL, Custom URL, and Dedicated URL services that SoftwareKey hosts, and self-hosted installations.
Are the Protection PLUS 5 SDK and Instant Protection PLUS 3 affected?
No. The licensing libraries you build into your application, the Protection PLUS 5 SDK (PLUSManaged and PLUSNative) and Instant Protection PLUS 3, do not contain Node.js. Applications protected with SoftwareKey licensing do not need an update for the October 2026 Node.js vulnerabilities.
Is SOLO Server affected by the Brotli flaw in CVE-2026-111497 outside Node.js?
No. CVE-2026-111497 is also a flaw in Google's open-source Brotli compression library (versions 1.0.3 through 1.2.0), so vulnerability scanners may flag other software that includes Brotli. The Brotli flaw is in the decoder, which only runs when software decompresses Brotli data.
SOLO Server does not decompress Brotli data. PLUSManaged and PLUSNative do not request or decompress compressed web service responses, so the Protection PLUS 5 SDK never runs a Brotli decoder. Instant Protection PLUS 3 does not use Brotli either.
Do I need to do anything?
You do not need to do anything for your SOLO Server account or your protected applications. Three situations involve Node.js that you manage yourself:
- Your application is built with Node.js or Electron. If your desktop application or service runs on Node.js or Electron and calls PLUSNative, the Node.js runtime belongs to your application and needs the update: Node.js 22.23.4, 24.22.1, 26.12.1, or later. An Electron application gets the Node.js fixes from its Electron version: Electron 45.1.0, 44.10.0, and 43.8.4, released October 27, 2026, include Node.js 24.22.1. PLUSNative itself is not affected.
- You call the SOLO Server web services (API) from Node.js. If your website, store, or back-office system uses Node.js code to create licenses or look up customers through the SOLO Server web services, that Node.js installation runs on your server and needs the update. SOLO Server itself is not affected.
- You self-host SOLO Server and installed Node.js on the same server for another application. SOLO Server does not need Node.js, so update Node.js for that other application or remove it.