# Vanta: Trust page changed

**Summary:** Vanta reported applying all necessary patches for Node.js vulnerabilities, including CVE-2026-111497, by October 22 following security updates on October 21. The Trust page also changed its displayed security controls; these listing changes do not establish that underlying protections were discontinued. _(machine-written, sol)_
- Kind: Trust / security · Label: Changed (not classified) (rule)
- Changed: 2026-10-23 09:01 UTC · Detected: 2026-10-23 09:01 UTC
- [Source: https://trust.vanta.com](https://trust.vanta.com)
- [Company: Vanta](https://rewindex.com/company/vanta.md)
- Versions: before page\_version:5410 → after page\_version:6246
- Change 5 of 6 for this page

## What changed

**1. Removed**

```diff
  …more Controls Updated ‹ago› View all Infrastructure Security
- Production database access restricted
  Remote access MFA enforced Remote access encrypted enforced…
```

**2. Added**

```diff
  …Remote access MFA enforced Remote access encrypted enforced
+ Production data segmented
  View ‹count› more Infrastructure Security controls Organizational Security…
```

**3. Changed**

```diff
  …Security controls Organizational Security Employee background checks performed
- Password policy enforced Security awareness training implemented
+ Security awareness training implemented Production inventory maintained
  View ‹count› more Organizational Security controls Internal Security…
```

**4. Removed**

```diff
  …the AI management system AI policy Product Security
- Data encryption utilized
  Vulnerability and system monitoring procedures established Data and…
```

**5. Changed**

```diff
  …and system monitoring procedures established Data and Privacy
- Privacy policy established Data retention procedures established Privacy compliant procedures established
+ Data retention procedures established Data classification policy established Data deletion requests handled
  View ‹count› more Data and Privacy controls Data…
```

**6. Added**

```diff
  …systems? Updates View all Security Vanta Response to
+ Node.js Vulnerabilities. Published ‹date› On Wednesday, October 21, Node.js released security updates for several vulnerabilities, including CVE-2026-111497. Vanta uses Node.js within the Vanta application, and when these patches were released, the Vanta security and engineering teams acted immediately to patch our production systems. As of Thursday, October 22, all necessary patches have been applied.
  Read more Read more about Vanta Response to…
```

**7. Added**

```diff
  …Read more Read more about Vanta Response to
+ Node.js Vulnerabilities.
  Security Vanta Response to PHP Vulnerabilities Published ‹date›…
```

**8. Removed**

```diff
  …Vanta's Government Solution is FedRAMP 20x Moderate Authorized
- General New Resource Uploaded -
  Vanta CMMC Shared Responsibility Matrix (CRM) Published ‹date›…
```

**9. Removed**

```diff
  …Uploaded - Vanta CMMC Shared Responsibility Matrix (CRM)
- Published ‹date› We have published a CMMC Shared Responsibility Matrix to provide transparency into how security responsibilities are shared between our organization and our customers. This document outlines responsibility boundaries across applicable CMMC practices and helps customers understand their role when using our software. You can view and download the matrix in Vanta’s Trust Center under Resources . Please let us know if you have any questions. Read more Read more about New Resource Uploaded -
  Vanta CMMC Shared Responsibility Matrix (CRM) Opens in…
```

## History of this page

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-19 08:59 UTC | [Trust page changed](https://rewindex.com/change/p2738.md) | Changed (not classified) |
| 2026-10-20 09:03 UTC | [Trust page changed](https://rewindex.com/change/p2934.md) | Changed (not classified) |
| 2026-10-21 08:57 UTC | [Trust page changed](https://rewindex.com/change/p4562.md) | Changed (not classified) |
| 2026-10-22 08:58 UTC | [Trust page changed](https://rewindex.com/change/p5410.md) | Changed (not classified) |
| 2026-10-23 09:01 UTC | Trust page changed (this change) | Changed (not classified) |
| 2026-10-24 09:02 UTC | [Trust page changed](https://rewindex.com/change/p7034.md) | Changed (not classified) |

Previous: [change](https://rewindex.com/change/p5410.md) · Next: [change](https://rewindex.com/change/p7034.md) · All Vanta changes: [timeline](https://rewindex.com/company/vanta/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/p6246 · Markdown: https://rewindex.com/change/p6246.md · JSON: https://rewindex.com/api/v1/changes/p6246 · Generated 2026-10-24T14:42:02.482Z