A Node.js security fix, and rotating your HonkIO credentials

On October 21 the Node.js project released a fix for CVE-2026-111497, a flaw in the Brotli decompression code that ships with Node.js. A crafted compressed payload can let an attacker run code on the server that decompresses it, and a proof of concept is public. The HonkIO API, the dashboard and the hosted MCP server all run on Node.js.

What we have done

• Patched: all three services were running the fixed release, Node.js 22.23.4, on October 23.
• Rotated: we replaced the internal secrets and credentials our services use.
• Signed everyone out: we ended every dashboard session, so you will be asked to sign in again. Your API keys and connected apps were not touched.

What we recommend

We have no reason to think your credentials were exposed. Still, the flaw allowed code to run on a server, and two days passed between its disclosure and our fix. So we recommend replacing the credentials you hold with us. It takes a few minutes, and you can do it without downtime.

API keys

To replace a key that is in use without an outage:

• Create a new key on the API Keys page, with the same permissions as the old one.
• Deploy the new key everywhere the old one is used.
• Watch the old key's "Last used" date on the same page. Once it stops changing, revoke the old key.

The Rotate button on that page works too, but it revokes the old key the moment it shows you the new one, so requests made with the old key fail until the new one is deployed. It suits a key you can replace in one step, such as one kept in a single environment variable.

A key that belongs to an app you connected by signing in, such as an AI agent, can't be rotated. Revoke it and connect the app again.

Webhook signing secrets

On the Webhooks page, choose Rotate secret for each endpoint, then update the secret your endpoint verifies signatures with. The SDKs can do it too: rotateSecret in Node.js and PHP, rotate_secret in Python.

The old secret stops signing at once. While you switch over, make sure your endpoint answers with an error to any delivery it cannot verify, rather than accepting it. We retry rejected deliveries, the first time a minute later, and every retry is signed with the new secret, so no event is lost.

Your password

Changing your password is optional. If you do, use Change password in Settings. It also disconnects apps you connected by signing in, so you will need to connect them again.

If you run the MCP server yourself

If you run @honkio/mcp with npx, it runs on your own Node.js. Update it to 22.23.4, 24.22.1, 26.12.1 or later. The hosted server at mcp.honkio.ca is already patched.

Questions are welcome through the contact page.