Patch week: GitLab, Node.js, Java and Plex, one by one

The short version

• GitLab: self-managed servers need 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. The flaw is rated 10.0 and lets an unauthenticated person run code on the server. GitLab.com is already fixed.
• Node.js: update to 22.23.4, 24.22.1 or 26.12.1. The worst fix is rated high, not critical. It includes the update that blocks the compromised eMudhra certificates.
• Java: install the Java update from Oracle's alert (CVE-2026-91403, rated 9.1). OpenJDK says it concerns the same eight compromised eMudhra certificates. Oracle does not list fixed version numbers on the alert page.
• Plex: update Plex Media Server to 1.43.3.10861 or later. Attackers are using a chain of four flaws to install a crypto miner and a back door on servers that are not updated.

GitLab: a second 10.0 in nine days

GitLab is the system many teams use to store code and run their build pipelines. On 21 October it released a critical patch for CVE-2026-110264. GitLab says that under certain conditions an unauthenticated user could run code on the server, through a specially crafted regular expression that overflows a number inside GitLab’s pattern-matching code. It rates it CVSS 10.0, the top of the scale.

This is a different flaw from CVE-2026-97229, a CVSS 10.0 in the same part of GitLab fixed on 12 October in 19.4.2, 19.3.5 and 19.2.8. Anyone who patched on 12 October still needs this update. GitLab’s release also fixes high-severity account takeover and cache poisoning bugs, and several medium and low ones.

Node.js: ten fixes, and one for eMudhra

Node.js is the engine behind many web servers and developer tools. Its 21 October security release covers the 22, 24 and 26 lines. Its own rating for the worst issue is high.

• Certificates: the update to the built-in list of trusted certificate authorities is titled “eMudhra Intermediate CA Compromise”. It stops Node.js from trusting the eight weak eMudhra keys. Our story on those keys explains why software outside browsers had to be updated separately.
• Brotli (CVE-2026-111497, high): an out-of-bounds write in the decoder that “permits remote code execution”, in all three lines.
• TLS (high): two bugs let a certificate pass a hostname check when an address is written in unusual ways, such as with full-width digits (CVE-2026-105483, CVE-2026-106069).
• DNS (CVE-2026-105482, high): dns.resolve cuts a name short when it contains a null character.
• Others: three medium and three low fixes, plus dependency updates for c-ares, OpenSSL, SQLite and Undici.

Node.js does not say any of these are being exploited. End-of-life versions get no fix and are affected.

Java: the eMudhra fix, rated 9.1

On 21 October Oracle published an out-of-band Security Alert for CVE-2026-91403, in the part of Java that handles secure connections (JSSE). It rates it CVSS 9.1 and says it is remotely exploitable without a login. Oracle’s page does not name eMudhra. The OpenJDK advisory published the same day does: it says the CVE “concerns eight compromised intermediate CA certificates”, the same eight weak keys we covered in our eMudhra story.

If your Java comes from your operating system (Debian, Ubuntu, Fedora, Red Hat, Oracle Linux, Arch, Gentoo or Devuan), OpenJDK says updating the system’s certificates is enough. Homebrew and FreeBSD packages must be updated directly. For a standalone runtime you cannot update yet, OpenJDK’s stop-gap is to replace the blocked.certs file in the JDK’s lib/security folder with the one it publishes (in JDK 8 the file is called blacklisted.certs), or to turn on certificate revocation checking.

Plex: attacks on a flaw patched in August

Plex Media Server lets people stream their own video and music, and many run one at home. In late July a researcher reported a set of flaws, and Plex fixed them on 3 August in version 1.43.3.10861. Technical details became public on 16 October. According to The Hacker News, attacks were recorded the next day.

No one has published how many servers are affected. Reports of hacked Plex servers on Reddit may not all come from this chain.

What to do

1. GitLab self-managed: upgrade to the patch release for your line today. If you already patched on 12 October, patch again. Look at the two detections GitLab lists.
2. Node.js: update to 22.23.4, 24.22.1 or 26.12.1, and rebuild containers that bake in an older Node.js. If you run a version that has reached end of life, plan the move.
3. Java: install the update in Oracle’s patch availability document, or update your operating system’s certificates if your Java comes from it. Repeat for every Java runtime you have installed, including ones bundled with other software.
4. Plex: update the server now. If it is reachable from the internet and you cannot update, take it offline until you can. Look for unfamiliar processes and a miner.
5. Everyone: keep a list of what you run. This week’s lesson is that an update you postponed can be the one that matters.

What we don’t know yet

• Whether the new GitLab flaw is being used in attacks.
• Whether the Node.js flaws are being used in attacks.
• Whether anyone is using the weak eMudhra keys against Java. Neither Oracle nor OpenJDK says so.
• The fixed Java version numbers. Oracle’s alert page leaves them to a separate document we could not read.
• How many Plex servers have been compromised.