Ignition is not affected by the October 21, 2026 Node.js security release, which fixed ten vulnerabilities in Node.js 22, 24, and 26 (patched in 22.23.4, 24.22.1, 26.12.1):
CVE-2026-111497 (Brotli decoder RCE, Critical, “Node2Shell”), CVE-2026-105482 (dns.resolve name truncation), CVE-2026-105483 (TLS hostname bypass, fullwidth digit IPs), CVE-2026-106069 (TLS hostname bypass via loose IP resolution), CVE-2026-105481 (keep alive socket early response), CVE-2026-106072 (non canonical IPv4 hostname validation), CVE-2026-106074 (repeated random values in snapshots and SEAs), CVE-2026-106070 (ZipFile), CVE-2026-106071 (Permission Model wildcard over grant), CVE-2026-106073 (Permission Model bypass via fs.realpathSync).
Ignition does not include or execute a Node.js runtime. All Ignition components (Gateway, Designer, Vision Client, Perspective, launchers, Workstation) run on the bundled Java runtime.
Node.js is used as a build tool for Ignition’s web frontends. The output is static JavaScript that runs in the browser; no Node code ships in the product. Scanners that match on package.json or lockfiles in Ignition’s source or build artifacts are flagging build tooling, not runtime exposure.
Engineering workstations may have Node.js installed separately for development tooling, including AI coding assistants and Ignition SDK or module projects. Such installs are customization by the asset owner, not delivered or maintained by Inductive Automation; patch or update this as you would any other developer tool or customized software.
This applies to future Node.js CVEs as well, unless this post is updated.
No customer action is required.