Following the security advisories published in October 2026 for Node.js and related components, we have reviewed the Lookatme7 platform and applied the vendor patches to every environment, including your production site. Below is a summary for your IT team.
What was patched
1. Node.js runtime (the server runtime for the platform's APIs and websites) Advisory: Node.js October 2026 security release, 21 October 2026. It fixes 10 vulnerabilities, including a high-severity flaw in Brotli decompression with potential for remote code execution. Previous version: 24.14.1 Now running: 24.22.1, the patched release on the Node.js 24 long-term support line
2. sharp image-processing library (generates previews and derivatives from uploaded images) Advisory: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a memory-safety flaw in SVG image processing on Linux Previous version: 0.35.0 Now running: 0.35.5
3. Next.js web framework (the platform's web front ends) Advisory: Next.js security update, 14 October 2026 Fixed: GHSA-p3m5-59mp-jv5r (denial of service through crafted requests) Assessed as not applicable: GHSA-673q-mjm6-r5xr, a remote code execution flaw that requires a framework feature the platform does not use. The SVG processing flaw in the same advisory is resolved by item 2. Previous version: 16.3.3 Now running: 16.4.1
*How the patches were applied Every platform service was rebuilt on updated base images and redeployed to our test, staging and production environments in turn. Each service was confirmed healthy after deployment. The patches were live in production on [date].
*Exposure assessment At the time of patching, the vendors had reported no exploitation of these vulnerabilities in the wild. [Include only if confirmed by Matt: We also reviewed our server logs for the period before patching and found no indicators of compromise.]
*Ongoing monitoring We scan the platform's running container images daily against published vulnerability databases. We raise and remediate fixable high and critical findings as part of our standard release process.
Lookatme continues to monitor Node.js and Next.js security advisories and will post any further updates here. For questions, please contact support@lookatmedam.com.
Thank you, Lookatme Cyber Security Team
Posted Oct 26, 2026 - 19:39 AEDT
Monitoring
*Component: Common Vulnerabilities and Exposures Lookatme has identified two security releases that apply to the Lookatme7 platform. A patch release is scheduled for tonight, 26 October 2026, after business hours (AEDT).
*Node.js – CVE-2026-111497 On 21 October 2026, the Node.js Project issued security releases fixing ten vulnerabilities across all supported Node.js release lines. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decompression library bundled with Node.js, with potential for remote code execution. Lookatme will upgrade Node.js to 24.22.1, the patched release for the 24.x line.
*Next.js – CVE-2026-96889 and GHSA-673q-mjm6-r5xr On 14 October 2026, the Next.js team at Vercel issued Next.js 16.4.1, fixing two critical remote code execution flaws – one in SVG image processing through the sharp image library, and one in Cache Components – along with a denial-of-service flaw. Lookatme will upgrade the Lookatme7 frontend to Next.js 16.4.1 in the same release.
Lookatme will post a further update here once the release is complete. For questions, please contact support@lookatmedam.com.
Thank you, Lookatme Cyber Security Team
Posted Oct 26, 2026 - 15:39 AEDT
This incident affected: Common Vulnerabilities and Exposures.