CVE-2026-111497 Google CVE debrief

Who should care

Defenders responsible for EasyApache 4 installations should assess exposure to CVE-2026-111497 and verify if their systems are using the updated ea-nodejs22 version 22.23.4 or later.

Why it matters

CVE-2026-111497 is a vulnerability fixed in EasyApache 4 25.92, which updates ea-nodejs22 to 22.23.4. Defenders responsible for EasyApache 4 installations should assess exposure and verify if their systems are using the updated version.

• Verify if your systems are using the updated ea-nodejs22 version 22.23.4 or later to prevent potential security risks.
• Assess the impact of CVE-2026-111497 on your systems and prioritize remediation efforts accordingly.

Technical summary

The CVE-2026-111497 vulnerability is fixed in EasyApache 4 25.92, which updates ea-nodejs22 to 22.23.4. This security release also rebuilds the ea-php74, ea-php80, and ea-php81 meta packages and updates the ea-tomcat101 change log. The CVE record was published on 2026-10-21T17:00:00.000Z and has not been modified since then. Defenders responsible for EasyApache 4 installations should assess exposure to CVE-2026-111497 and verify if their systems are using the updated ea-nodejs22 version 22.23.4 or later. The vulnerability is a security update for EasyApache 4.

Defensive priority

Defenders should prioritize verifying exposure to EasyApache 4 25.92 and assessing the impact of CVE-2026-111497 on their systems.

Recommended defensive actions

• Verify exposure to EasyApache 4 25.92 and assess the impact of CVE-2026-111497 on your systems.
• Check if your systems are using the updated ea-nodejs22 version 22.23.4 or later.
• Review the EasyApache 4 change log for a full list of changes.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The source corpus provides limited information about CVE-2026-111497, but it mentions that the vulnerability is fixed in EasyApache 4 25.92, which updates ea-nodejs22 to 22.23.4. The CVE record was published on 2026-10-21T17:00:00.000Z and has not been modified since then. Defenders should verify exposure to EasyApache 4 25.92 and assess the impact of CVE-2026-111497 on their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.