Skip to main content

Security update: Metafields Guru and the October 2026 PHP and Node.js vulnerabilities

· 3 min read
Metafields Guru Team
Metafields Guru Team
Metafields Guru

On October 21, 2026, PHP and Node.js both released critical security fixes, and many merchants are now checking their app vendors. Here is where Metafields Guru stands: we don't use PHP, so the PHP vulnerabilities don't affect us, and all our servers were updated to the fixed Node.js release the same day. Metafields Guru is working as usual, and you don't need to do anything in your store.

Summary​

  • PHP - not used in Metafields Guru, so not affected.
  • Node.js - all servers updated to Node.js 24.22.1, the fixed release as of October 21, 2026 (Node.js advisory).
  • Your store - no reinstall, settings changes, or theme updates needed.

FAQ​

Is Metafields Guru affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619)?​

No. Metafields Guru does not use PHP anywhere.

Which Node.js version does Metafields Guru run on?​

As of October 21, 2026, Metafields Guru runs on Node.js 24.22.1, the fixed release from the Node.js security release published that day. We keep Node.js up to date, so later security releases will move us to newer versions.

Questions?​

If anything about this update is unclear, our support team is always happy to help.