Security notices

On this page we publish our statements on security notices that concern TAS or the technologies TAS runs on. The latest notice is at the top.

12 Nov 2026 – Node.js – security notice

TAS is not affected and no action is required from you. None of the reported vulnerabilities can be exploited in TAS, and there is no known exploitation against TAS.

On 11 Nov 2026 the vendor of Node.js, the platform TAS runs on, released fixes for 16 vulnerabilities (7 of them rated High). They mainly concern the HTTP/2 protocol and encrypted connections (HTTPS/TLS). We checked all supported TAS versions:

  • TAS does not use the HTTP/2 protocol, which 7 of the reported vulnerabilities depend on. Node.js only uses HTTP/2 when it is explicitly enabled, and no TAS version enables it.
  • In a standard TAS installation, HTTPS is not handled by Node.js but by the proxy server in front of the application, so the encrypted-connection vulnerabilities do not apply to TAS.
  • The remaining vulnerabilities concern Node.js features TAS does not use.

TAS version

Exploitable

Action

4.15, 5.7

No

Not needed

5.17, 5.19

No

Preventive Node.js update in the next regular TAS version

5.21

No

Already includes the fixed Node.js version

The preventive update changes nothing for users or configuration and does not require an extra upgrade.

Keep HTTPS on the proxy server in front of TAS and do not expose the application ports directly to the internet. If you run TAS differently, contact us and we will assess it together.
Assessed vulnerabilities
High: CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-126051, CVE-2026-123872, CVE-2026-123874
Medium: CVE-2026-123828, CVE-2026-123867, CVE-2026-123868, CVE-2026-123871, CVE-2026-123877, CVE-2026-123875
Low: CVE-2026-123829, CVE-2026-123862, CVE-2026-106071

26 Oct 2026 – Node.js – Broccoli2Shell

On 21 Oct 2026 the vendor of Node.js announced vulnerability CVE-2026-111497, rated High, in data decompression. There is no known exploitation against TAS.

  • It can only be exploited when TAS itself calls an external server controlled by an attacker.
  • User data from forms and the TAS API are not affected.

TAS version

Fix

Fixed version

Available since

4.15

Fix in TAS

4.15.150

27 Oct 2026

5.7

Fix in TAS

5.7.106

27 Oct 2026

5.17

Node.js update

5.17.18

27 Oct 2026

5.19

Node.js update

5.19.9

27 Oct 2026

Install the fixed version of your release line at the earliest opportunity. It is a regular upgrade with no change for users or configuration, and integrations keep working. If we handle your upgrades, we will contact you with a proposed date.

We recommend upgrading to the latest TAS version

Versions 4.15 and 5.7 run on an older Node.js release that the vendor no longer maintains. Any future vulnerabilities in them have to be fixed separately in TAS, which is not always possible and always takes longer. Versions 5.17 and newer run on a Node.js release supported by the vendor.

Customers on versions 4.15 and 5.7 should plan a migration. We will be glad to go through the scope with you and propose a date.

Syca (opens in a new tab)

Powered by HelpDocs (opens in a new tab)