Node.js vulnerability scan

Question

Hi all,We're currently investigating a vulnerability finding relating to Node.js 22.22.2 in relation to CVE-2026-111497, which appears to be bundled with Adobe Creative Cloud.Has anyone else encountered this finding, or does anyone know whether the bundled version is actually exposed to this vulnerability based on how Adobe uses Node.js?It would also be helpful to know whether Adobe plans to update the bundled Node.js version in an upcoming Creative Cloud update, and whether there is any official guidance regarding the risk or impact of CVE-2026-111497 in this particular implementation.If any Adobe representatives are active here, an official clarification would be greatly appreciated.Thanks!

Tariq Ahmad Dar · Answer

Hi ​@angular_Flair2fa1,Thanks for the detailed report. We’ll forward this internally to the appropriate team for review.In the meantime, you can also report this directly to Adobe’s Product Security Incident Response Team at psirt@adobe.com, including the Node.js version, the exact file/component path you identified, and your scan details. You can also check Adobe’s official Security Bulletins & Advisories page for any bulletin once published: https://adobe.ly/4yMMXpbWe’ll make sure this is tracked through the appropriate channel.​@kglad, just to clarify, this specific CVE was only made public in October 2026, so it’s a new report, not something that’s been sitting unaddressed for over a year. Replacing the bundled Node.js file yourself isn’t something we can confirm is safe or recommend, even if it hasn’t caused visible problems for some users.Thanks,Tariq

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.