PHP and Node.js October 2026 vulnerabilities: what they mean for FileMaker Server Print

The short version

On FileMaker Server 19.6.4 and later, the October 21 Node.js flaw looks unreachable, but the Node.js that FileMaker bundles is still unpatched. As of October 24, the newest build we run (FileMaker Server 26.0.3) still ships a Node.js without the fix, and we could not find a Claris statement about it.

• Node.js: every build from 19.6.4 up, on Windows and Linux, bundles a Node.js without the fix: 16.16.0 in 19.6.4, 22.14.0 in 21.1.8, and 22.23.1 in 22.0.7 and 26.0.3. It runs only for the FileMaker Data API. We found no way for attacker-controlled Brotli data to reach it, which is our analysis, not a Claris statement.
• PHP: none of the builds we audited bundle PHP, so the PHP flaws only matter for PHP you run alongside FileMaker Server, such as WordPress or a hosting panel.
• What to do: check whether the Data API is on, keep port 3000 off the internet, update any PHP or Node.js you run yourself, and upgrade anything on 19.6.4 or older.

This article covers FileMaker Server 19.6.4 and later, on Windows and Linux. We include 19.6.4 for information because many people still run it, but it is end of life, and so is everything older, so upgrade. Everything below comes from read-only checks on our own servers on October 24 and 25, 2026, and we mark what we verified and what we inferred.

What was released on October 21

PHP. Two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, were fixed on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The php.net advisory says updating is the only complete fix. PHP 8.1 and older get no updates from the project, though minimal backports for 7.4, 8.0 and 8.1 were published on GitHub and some distributions and long-term-support vendors ship their own fixes. If you cannot update right away, the advisory suggests setting session.upload_progress.enabled=0 and restarting all PHP workers, which reduces exposure but does not make an install safe. Bitsight's summary gives each flaw a CVSS v4.0 score of 9.2, says every PHP serving web requests is affected (including php-cgi, PHP-FPM and mod_php), and reports early exploitation.

Node.js. The same day, Node.js shipped 22.23.4, 24.22.1 and 26.12.1 in its October 2026 security releases. One of the fixes is CVE-2026-111497, rated High: an out-of-bounds write in the bundled Brotli decoder that can lead to a crash, memory disclosure or remote code execution. Node's advisory says the attacker must supply Brotli data that an application decompresses with node:zlib. It does not mention fetch(); one third-party write-up says fetch() reaches the decoder whenever a response says Content-Encoding: br, and we have not confirmed that. Node's advisory does not name end-of-life lines, but notes they are always affected; the write-up names v25, v23 and v20.

The fix also adds a new constant, BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH, to Node's zlib. We use that to tell patched builds from unpatched ones (see "Check your own server").

Where Node.js and PHP live inside FileMaker Server

Node.js is bundled with FileMaker Server (node\node.exe under the install folder on Windows, /opt/FileMaker/FileMaker Server/node/bin/node on Linux). On the builds we looked at, it runs one thing: the Data API application in the Web Publishing folder, an Express app listening on port 3000. The web server proxies /fmi/data/ to it. OData is a separate process (fmodata, port 3001) and is not Node. On our test server, Node only started after we enabled the Data API; turning on WebDirect did not start it.

PHP is not bundled with the builds we audited. If you run PHP alongside FileMaker Server, for example for WordPress or a hosting panel, it is a separate install and you need to update it yourself.

What we found, by version

Windows and Linux builds of the same FileMaker Server version bundle the same Node.js. Each row is one build we audited, so check your own. "Has the fix" comes from the zlib probe described under "Check your own server".

The fixed Node releases are 22.23.4, 24.22.1 and 26.12.1, so a Node update from Claris would close the gap on the 22.x builds. None of the builds we audited bundle PHP. FileMaker Server 19.6.4 is end of life, as is everything older.

Is the Node.js flaw reachable through FileMaker Server?

In the configurations we saw, we found no path for it, but we have not tested a live attack and Claris has not said anything. The flaw needs Node to decode Brotli data that an attacker controls, so we looked for each way that could happen.

• Incoming requests (verified): the Data API uses Express with body-parser 1.x (versions 1.18.2 to 1.20.4). None of the body-parser copies we scanned on the Linux builds contain the word "brotli". We did not repeat the scan on Windows, whose builds bundle the same Node.js versions.
• Outgoing requests (inferred): Node's fetch() is the route the write-up describes. We did not read the Data API application's code, so we cannot say whether it ever fetches from a server an attacker controls. Node 16, bundled in FMS 19.6.4, has no built-in fetch(); the 22.x builds do.
• Exposure of the port (check yours): the Data API listens on port 3000. On Linux the web server proxies /fmi/data/ to it. If port 3000 is open to the internet on your server, close it.
• Linux system library (inferred): FileMaker components on Linux link the system libcurl, which links the system libbrotli. The versions we saw (1.0.7 on Ubuntu 20.04, 1.0.9 on 22.04, 1.1.0 on 24.04) are numerically inside the affected range the write-ups give (1.0.3 to 1.2.0). Ubuntu may have backported a fix, and we could not confirm its status. The exposure would be FileMaker fetching a response from a hostile server.

"No path we know of" is not "patched". We would still want Claris to ship the fix.

What to do

1. Find out whether the Data API is on. If a node process is running on your server, it is. If you do not use the Data API, turn it off in the Admin Console; on our test server, Node did not start without it.
2. Keep port 3000 off the internet. Only the web server should reach it. Test from outside your network with nc -vz <server-ip> 3000 (Linux or macOS) or Test-NetConnection <server-ip> -Port 3000 (Windows). A refused or timed-out connection is what you want.
3. Update Node.js you installed yourself. Move to 22.23.4, 24.22.1, 26.12.1 or later. Lines 20 and older, 23 and 25 get no fix, so move to a supported line. This includes Node apps in containers.
4. Check any integrations with FileMaker Server that use PHP, such as WordPress and hosting panels. They should be on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Check the advisory on php.net for your branch.
5. On Linux, watch for the library fix. When Ubuntu publishes an update for libbrotli1, apply it and restart FileMaker Server. apt-cache policy libbrotli1 shows the installed version.
6. Upgrade anything on 19.6.4 or older. Those builds are end of life, and a current FileMaker Server build is the only real fix for them.
7. Watch for Claris. We could not find a statement from Claris as of October 24. Ask Claris support or your Claris partner contact whether and when the bundled Node.js will be updated.

Check your own server

These commands only read. Run them as an administrator.

Windows (PowerShell)

$root = 'C:\Program Files\FileMaker\FileMaker Server'
# Bundled Node.js: version, then the Brotli-fix probe
Get-ChildItem $root -Recurse -Filter node.exe -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName; & $_.FullName -v; & $_.FullName -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH || 'missing'" }
# Is Node running (is the Data API on)?
Get-Process node -ErrorAction SilentlyContinue | Select-Object Id,Path
# Any PHP installed?
Get-ChildItem 'C:\Program Files','C:\Program Files (x86)' -Recurse -Filter php.exe -ErrorAction SilentlyContinue | ForEach-Object { $_.FullName; & $_.FullName -v }
# Is PHP wired into IIS?
Import-Module WebAdministration
Get-WebHandler | Where-Object { $_.Path -like '*php*' -or $_.ScriptProcessor -like '*php*' } | Select-Object Name,Path,ScriptProcessor

Linux (bash)

find /opt/FileMaker -type f -name node -perm -u+x -print0 | while IFS= read -r -d '' n; do echo "$n"; "$n" -v; "$n" -p "require('zlib').constants.BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH || 'missing'"; done
ps -eo pid,user,cmd | grep -i '[n]ode'
ss -ltnp | grep -i node
apt-cache policy libbrotli1 | head -3

Reading the probe. A patched Node prints a number (-17 on the patched 22.23.4 build we tested). An unpatched one prints missing. Very old Node versions fail with a TypeError because they have no zlib.constants at all; that is expected and means the build predates Node's Brotli support. The constant comes from the fix itself, as the release notes list it, but it is a marker and not an official patch test.

Sources

• php.net: Security advisory, critical remote code execution vulnerabilities (October 21, 2026): primary source for the PHP flaws, fixed versions and mitigation.
• Node.js: Wednesday, October 21, 2026 Security Releases: primary source for the Node.js fixes and the Brotli flaw.
• Bitsight: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell): severity scores and exploitation reports.
• Node.js v24.22.1 fixes four HIGH CVEs (lilting.ch): the fetch() path claim and end-of-life lines.
• Node.js v22.23.4 release notes (NewReleases): release date and the Brotli change.
• Version data: read-only checks on ODITech's own servers, October 24 and 25, 2026.