ONLYOFFICE Docs patches the October 2026 Node.js vulnerability

Keeping your documents safe is a top priority for us. When the Node.js project disclosed a new security vulnerability in its recent security releases, our team moved quickly to patch it. ONLYOFFICE Docs Enterprise and ONLYOFFICE Docs Developer now run on an updated, secure version of Node.js. The same update for the Community build will follow later.

How Node.js is used in ONLYOFFICE Docs

Node.js is used for server-side scripting and backend services in ONLYOFFICE Docs. It powers the background services that the front-end editors communicate with. The most critical components are:

• Co-authoring Document Service: Manages real-time document collaboration and multi-user editing sessions on the server side.
• File conversion: Handles document conversion requests by queuing them, passing files to the native ONLYOFFICE conversion engine (C++), which converts between office formats such as DOCX, XLSX, PPTX, and PDF, and storing the results.
• Metrics: Collects service statistics and exports them via StatsD.
• Integration layer: Connects ONLYOFFICE Docs to external services – including the database, Redis, the message queue, and file storage – verifies requests with JWT, and exposes the integration APIs used by host applications, such as callbacks, the Command Service, Conversion API, Document Builder API, and WOPI.

What was the vulnerability?

On October 21st, 2026, the Node.js team published security releases that fixed newly found weaknesses in this engine. Issues like this can give attackers a way to disrupt services or reach data they shouldn’t access. That’s why the Node.js team released fixed versions, and why software built on Node.js needs to adopt them quickly.

Why this update matters for you

Even if you never interact with Node.js directly, it still affects you. Your ONLYOFFICE Docs server depends on it to open, edit, and save documents, so any weakness in Node.js could become a weakness in your workspace.

Updating the engine closes that gap. Your team can keep co-editing files, sharing documents, and working together without extra risk. This matters most for organizations that store sensitive information or open files from outside sources.

Which builds are updated

As soon as the vulnerability was disclosed, we reviewed its impact and prepared a fix. Node.js was updated to version 24.22.1 across the Ubuntu, CentOS, Windows, and Docker builds of ONLYOFFICE Docs Enterprise and ONLYOFFICE Docs Developer. This update includes the official security patches from the Node.js project.

We know that many organizations don’t run the very latest release. To support you, we created two dedicated fix branches:

• branch 10.0.2, based on version 10.0;
• branch 9.4.2, based on version 9.4.

The Community build of the editors will receive the same update later.

Stay protected

Update your ONLYOFFICE Docs installation today to keep your documents and your team protected. Check Help Center

INSTALLATION PACKAGES

If you’re not the person who manages your ONLYOFFICE server, simply share this post with your IT administrator. The update is straightforward, and it only takes a short time to keep your whole team safe.

Where can I report a security vulnerability?

If you discover a security issue in ONLYOFFICE, please report it responsibly through our official security contact security@onlyoffice.com. You are also welcome to visit our Security – Contact Us page. We review all reports and will work with you to address the issue as quickly as possible.