Vanta reported applying all necessary patches for Node.js vulnerabilities, including CVE-2026-111497, by October 22 following security updates on October 21. The Trust page also changed its displayed security controls; these listing changes do not establish that underlying protections were discontinued.
Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.
What changed
Struck in red is what Vanta removed; blue is what they added. Muted text is unchanged context.
Before: …Remote access MFA enforced Remote access encrypted enforced nothing here View ‹count› more Infrastructure Security controls Organizational Security…
After: …Remote access MFA enforced Remote access encrypted enforced Production data segmented View ‹count› more Infrastructure Security controls Organizational Security…
Changed#3
Before: …Security controls Organizational Security Employee background checks performed Password policy enforced Security awareness training implemented View ‹count› more Organizational Security controls Internal Security…
After: …Security controls Organizational Security Employee background checks performed Security awareness training implemented Production inventory maintained View ‹count› more Organizational Security controls Internal Security…
Removed#4
Before: …the AI management system AI policy Product Security Data encryption utilized Vulnerability and system monitoring procedures established Data and…
After: …the AI management system AI policy Product Security removed Vulnerability and system monitoring procedures established Data and…
Changed#5
Before: …and system monitoring procedures established Data and Privacy Privacy policy established Data retention procedures established Privacy compliant procedures established View ‹count› more Data and Privacy controls Data…
After: …and system monitoring procedures established Data and Privacy Data retention procedures established Data classification policy established Data deletion requests handled View ‹count› more Data and Privacy controls Data…
Added#6
Before: …systems? Updates View all Security Vanta Response to nothing here Read more Read more about Vanta Response to…
After: …systems? Updates View all Security Vanta Response to Node.js Vulnerabilities. Published ‹date› On Wednesday, October 21, Node.js released security updates for several vulnerabilities, including CVE-2026-111497. Vanta uses Node.js within the Vanta application, and when these patches were released, the Vanta security and engineering teams acted immediately to patch our production systems. As of Thursday, October 22, all necessary patches have been applied. Read more Read more about Vanta Response to…
Added#7
Before: …Read more Read more about Vanta Response to nothing here Security Vanta Response to PHP Vulnerabilities Published ‹date›…
After: …Read more Read more about Vanta Response to Node.js Vulnerabilities. Security Vanta Response to PHP Vulnerabilities Published ‹date›…
Removed#8
Before: …Vanta's Government Solution is FedRAMP 20x Moderate Authorized General New Resource Uploaded - Vanta CMMC Shared Responsibility Matrix (CRM) Published ‹date›…
After: …Vanta's Government Solution is FedRAMP 20x Moderate Authorized removed Vanta CMMC Shared Responsibility Matrix (CRM) Published ‹date›…
Removed#9
Before: …Uploaded - Vanta CMMC Shared Responsibility Matrix (CRM) Published ‹date› We have published a CMMC Shared Responsibility Matrix to provide transparency into how security responsibilities are shared between our organization and our customers. This document outlines responsibility boundaries across applicable CMMC practices and helps customers understand their role when using our software. You can view and download the matrix in Vanta’s Trust Center under Resources . Please let us know if you have any questions. Read more Read more about New Resource Uploaded - Vanta CMMC Shared Responsibility Matrix (CRM) Opens in…
Compared with the previous archived version (#5410 to #6246). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
Vanta reported applying all necessary patches for Node.js vulnerabilities, including CVE-2026-111497, by October 22 following security updates on October 21. The Trust page also changed its displayed security controls; these listing changes do not establish that underlying protections were discontinued.
Vanta added “Penetration Test Status of Findings (Oct 2026)” and a PHP vulnerability response stating its application does not use PHP and production infrastructure is unaffected. Displayed controls replace “Production inventory maintained” with “Password policy enforced”; the SOC 2 report announcement was removed. These update customer-facing security disclosures without establishing changes to underlying controls.
Vanta’s trust page removed “Password policy enforced” and added “Production inventory maintained” in the visible Organizational Security controls list. This changes the controls shown to customers, but the diff does not establish whether the underlying controls changed.
Vanta’s Trust page removed the question “How does Vanta handle access controls and authentication?” This is a page-content change; the evidence does not show any change to Vanta’s security controls.
Vanta’s Trust page added the question “How does Vanta handle access controls and authentication?” The diff shows no answer or security-control change, so this is informational wording only.