We have finished addressing the Node.js vulnerabilities (CVE-2026-111497 and others) in all seven RuffRuff apps. We have applied the security fixes that Node.js published on October 21, 2026 to the affected servers of all seven apps.
Key points
- We updated the affected servers of all seven apps to the fixed version of Node.js (22.23.4)
- The update was applied to the production environments of all seven apps on October 22, 2026
- Store owners do not need to change any settings or reinstall the apps
Apps covered by this notice
- RuffRuff 予約販売
- RuffRuff Order Limits
- RuffRuff Order Bonus
- RuffRuff Selling Periods
- RuffRuff Table of Contents
- RuffRuff Product & Blog Tags
- RuffRuff Author Profiles
What we did
On October 21, 2026, Node.js released security fixes. They include a fix for a vulnerability in the decompression of Brotli-compressed data (CVE-2026-111497). Because all seven RuffRuff apps use Node.js, we updated them to the fixed version, Node.js 22.23.4.
Date applied
October 22, 2026 (JST)
What store owners need to do
You do not need to change any RuffRuff app settings or reinstall the apps in response to this issue. You can continue using them as usual.
We will provide an update if the situation changes.
