October 2026 PHP and Node.js security notices: TransLABtor customer sites
Customer notice, 26 October 2026. TransLABtor does not use PHP. Sites run Node.js 26, and the Node.js Brotli memory-leak issue does not apply to the way TransLABtor uses that runtime.
- cybersecurity
- lab IT
- on-premise
- lab middleware
- Node.js
- customer notice
Who this is for
Laboratory IT and anyone responsible for a TransLABtor server. On 21 October 2026, PHP and Node.js both published urgent security fixes. This note states how those issues relate to TransLABtor installations.
PHP
The PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, often called php2shell. They allow unauthenticated remote code execution when PHP handles a web request. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. On 26 October 2026, CISA added both identifiers to its Known Exploited Vulnerabilities catalog.
TransLABtor does not use PHP. The product does not install a PHP interpreter, PHP-FPM, or a PHP handler in IIS. A TransLABtor site serves the clinical UI as static files and forwards the API to the local TransLABtor service. php2shell does not apply to a TransLABtor installation.
Node.js 26
TransLABtor customer servers run Node.js 26, bundled with the product. The Node.js security release of 21 October 2026 includes CVE-2026-111497, a flaw in the Brotli decoder shipped with Node.js. Malformed compressed input can write past an internal buffer. Public descriptions of the impact include a crash, disclosure of process memory, or remote code execution.
That leakage happens when the application decompresses attacker-controlled Brotli data through Node’s zlib decoder, including when fetch() automatically decompresses a Brotli response from another server. The patched Node.js 26 build is 26.12.1.
TransLABtor is not exposed to this leakage. The Node.js 26 service does not decompress untrusted Brotli input, and it does not retrieve remote Brotli responses. Clinical analyzers connect over TCP or TLS using laboratory protocols such as HL7 and ASTM. Those sockets are not HTTP content-encoding. The API accepts ordinary HTTP requests on the laboratory server. It does not inflate a Brotli body in order to handle them.
What to do on a TransLABtor server
No emergency TransLABtor patch or shutdown is required for these two notices.
- Leave the TransLABtor services running.
- Confirm the runtime if you wish:
C:\TransLabtor\runtime\node\node.exe -vshould report a Node.js 26 version. - Apply your normal Windows and PostgreSQL maintenance on your existing schedule.
Questions from a site already in production can go through TransLABtor support at [email protected], or contact us.