On FileMaker Server 19.6.4 and later, the October 21 Node.js flaw looks unreachable, but the Node.js that FileMaker bundles is still unpatched. As of October 24, the newest build we run (FileMaker Server 26.0.3) still ships a Node.js without the fix, and we could not find a Claris statement about it.
This article covers FileMaker Server 19.6.4 and later, on Windows and Linux. We include 19.6.4 for information because many people still run it, but it is end of life, and so is everything older, so upgrade. Everything below comes from read-only checks on our own servers on October 24 and 25, 2026, and we mark what we verified and what we inferred.
PHP. Two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, were fixed on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The php.net advisory says updating is the only complete fix. PHP 8.1 and older get no updates from the project, though minimal backports for 7.4, 8.0 and 8.1 were published on GitHub and some distributions and long-term-support vendors ship their own fixes. If you cannot update right away, the advisory suggests setting session.upload_progress.enabled=0 and restarting all PHP workers, which reduces exposure but does not make an install safe. Bitsight's summary gives each flaw a CVSS v4.0 score of 9.2, says every PHP serving web requests is affected (including php-cgi, PHP-FPM and mod_php), and reports early exploitation.
Node.js. The same day, Node.js shipped 22.23.4, 24.22.1 and 26.12.1 in its October 2026 security releases. One of the fixes is CVE-2026-111497, rated High: an out-of-bounds write in the bundled Brotli decoder that can lead to a crash, memory disclosure or remote code execution. Node's advisory says the attacker must supply Brotli data that an application decompresses with node:zlib. It does not mention fetch(); one third-party write-up says fetch() reaches the decoder whenever a response says Content-Encoding: br, and we have not confirmed that. Node's advisory does not name end-of-life lines, but notes they are always affected; the write-up names v25, v23 and v20.
The fix also adds a new constant, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, to Node's zlib. We use that to tell patched builds from unpatched ones (see "Check your own server").
Node.js is bundled with FileMaker Server (node\node.exe under the install folder on Windows, /opt/FileMaker/FileMaker Server/node/bin/node on Linux). On the builds we looked at, it runs one thing: the Data API application in the Web Publishing folder, an Express app listening on port 3000. The web server proxies /fmi/data/ to it. OData is a separate process (fmodata, port 3001) and is not Node. On our test server, Node only started after we enabled the Data API; turning on WebDirect did not start it.
PHP is not bundled with the builds we audited. If you run PHP alongside FileMaker Server, for example for WordPress or a hosting panel, it is a separate install and you need to update it yourself.
Windows and Linux builds of the same FileMaker Server version bundle the same Node.js. Each row is one build we audited, so check your own. "Has the fix" comes from the zlib probe described under "Check your own server".
|
FMS version (Windows and Linux) |
Bundled Node.js |
Has the Brotli fix |
Fix available upstream |
|---|---|---|---|
|
19.6.4 |
16.16.0 |
no |
no, Node 16 is end of life |
|
21.1.8 |
22.14.0 |
no |
yes, 22.23.4 |
|
22.0.7 |
22.23.1 |
no |
yes, 22.23.4 |
|
26.0.3 |
22.23.1 |
no |
yes, 22.23.4 |
The fixed Node releases are 22.23.4, 24.22.1 and 26.12.1, so a Node update from Claris would close the gap on the 22.x builds. None of the builds we audited bundle PHP. FileMaker Server 19.6.4 is end of life, as is everything older.
In the configurations we saw, we found no path for it, but we have not tested a live attack and Claris has not said anything. The flaw needs Node to decode Brotli data that an attacker controls, so we looked for each way that could happen.
fetch() is the route the write-up describes. We did not read the Data API application's code, so we cannot say whether it ever fetches from a server an attacker controls. Node 16, bundled in FMS 19.6.4, has no built-in fetch(); the 22.x builds do./fmi/data/ to it. If port 3000 is open to the internet on your server, close it.libbrotli. The versions we saw (1.0.7 on Ubuntu 20.04, 1.0.9 on 22.04, 1.1.0 on 24.04) are numerically inside the affected range the write-ups give (1.0.3 to 1.2.0). Ubuntu may have backported a fix, and we could not confirm its status. The exposure would be FileMaker fetching a response from a hostile server."No path we know of" is not "patched". We would still want Claris to ship the fix.
node process is running on your server, it is. If you do not use the Data API, turn it off in the Admin Console; on our test server, Node did not start without it.nc -vz <server-ip> 3000 (Linux or macOS) or Test-NetConnection <server-ip> -Port 3000 (Windows). A refused or timed-out connection is what you want.libbrotli1, apply it and restart FileMaker Server. apt-cache policy libbrotli1 shows the installed version.These commands only read. Run them as an administrator.
Windows (PowerShell)
$root = 'C:\Program Files\FileMaker\FileMaker Server'
# Bundled Node.js: version, then the Brotli-fix probe
Get-ChildItem $root -Recurse -Filter node.exe -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName; & $_.FullName -v; & $_.FullName -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH || 'missing'" }
# Is Node running (is the Data API on)?
Get-Process node -ErrorAction SilentlyContinue | Select-Object Id,Path
# Any PHP installed?
Get-ChildItem 'C:\Program Files','C:\Program Files (x86)' -Recurse -Filter php.exe -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName; & $_.FullName -v }
# Is PHP wired into IIS?
Import-Module WebAdministration
Get-WebHandler | Where-Object { $_.Path -like '*php*' -or $_.ScriptProcessor -like '*php*' } | Select-Object Name,Path,ScriptProcessorLinux (bash)
find /opt/FileMaker -type f -name node -perm -u+x -print0 | while IFS= read -r -d '' n; do echo "$n"; "$n" -v; "$n" -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH || 'missing'"; done
ps -eo pid,user,cmd | grep -i '[n]ode'
ss -ltnp | grep -i node
apt-cache policy libbrotli1 | head -3Reading the probe. A patched Node prints a number (-17 on the patched 22.23.4 build we tested). An unpatched one prints missing. Very old Node versions fail with a TypeError because they have no zlib.constants at all; that is expected and means the build predates Node's Brotli support. The constant comes from the fix itself, as the release notes list it, but it is a marker and not an official patch test.
fetch() path claim and end-of-life lines.