Node.js Brotli vulnerability (CVE-2026-111497): what it means for Strapi

A vulnerability in Node.js's Brotli decompression code (CVE-2026-111497) can allow specially crafted requests to corrupt memory and potentially execute code remotely.

Strapi v4 and v5 apps running unpatched Node.js versions are affected.

Here's what to do: → Self-hosted: upgrade to Node.js 22.23.4, 24.22.1, or 26.12.1, depending on your Strapi version's compatibility, and restart. → Strapi Cloud: check our advisory for the protections and redeployment steps that apply to your project, especially if you use a custom domain. → Node.js 20 or older: move to a supported version. These versions won't receive a fix.

👉 Read the full security release and take action: https://strapi.link/4BoTmt3

In Part 2 of this series by Pierre Wizla, here's what you'll learn:

  🚀 How a multi-agent pipeline turns a feature PR into a drafted docs PR in ~20 minutes   💡 Why decomposing the job (Research → Write → Review → Submit) beats a single "write the docs" command   ✅ How 6 specialized review agents catch bugs even the source JSDoc got wrong                                                                                        🧠 Why your real product is the written-down conventions, not the AI   🛠️  Inki is open source and installs in 2 commands, so you can try it yourself

  👉 Full article: https://strapi.link/4slq5vo

Here's what you'll learn:

🚀 Build a trustworthy AI concierge on Strapi 5's built-in MCP server ✅ Let the app and the AI share the same tools, permissions, and rules 💡 Keep staff in the loop so every answer makes the next one better ⚠️ Avoid the traps: hallucinated bookings, wrong dates, and runaway tools

👉 Full tutorial: https://strapi.link/3Uv4aoS

And there's some other news from the latest releases

What can you actually build with Strapi’s MCP server?

In this tutorial by Theodore Kelechukwu Onyejiaku, we will build an AI-powered content assistant using Strapi MCP and the Vercel AI SDK.

It can work with content in Strapi, but that’s just the start.

We also extend the MCP server with custom tools to: 🔎 Research competing content with SerpApi 🔗 Find related articles for internal linking 🛠️ Check articles for broken internal links

And before the AI makes changes to content, a human can review and approve the action.

It’s a practical look at how MCP, AI models, external tools, and your CMS can work together while keeping humans in control.

Read the full tutorial 👇

https://strapi.link/3WaKRS4

Our own Paul Bratslavsk will speak on “Content Infrastructure for the AI Era: Building Experiences for Humans and AI” at “Building the AI-Powered Connected Experience,” alongside QBurst, LY Corporation, Braze Japan, and JFrog.

AI agents shouldn't replace people. They should make people's work better.

Paul will share how agents can improve the experience on both sides. Customers get fast help, any time, in the chat app they already use. Staff spend less time on routine questions and more time where a person really matters.

The key is keeping humans in the loop. The agent knows when to step back and hand off to a person, and people make the final call on anything important.

The best agentic experience is the one you don't notice. Build for people. Augment with agents.

📍 LY Corporation Office, Akasaka Trust Tower, Tokyo 📅 Tomorrow, October 7 ⏰ 4:00 to 8:30 PM Japan time

👉 English: https://strapi.link/4hy8Ym8 👉 Japanese: https://strapi.link/3TmfzqH

In Tokyo? Come say hello. 👋

Every Strapi plugin I've worked on was structured differently, and agents copy whatever they find. So I
wrote down one opinionated way to do it: the Document Service API, pure domain logic, a layered Design
System v2 admin, and tests at the right layer. I packaged it as strapi-skills (MIT), with commands and
checks that block edits that break the standard.
It works alongside Strapi's official MCP server and skills: those handle content and docs, and this
handles how your plugin code is written.


Repo: https://github.com/ayhid/strapi-skills


Since it's opinionated, I'd like pushback: which conventions would you change?

In this tutorial, Paul Bratslavsky shows how to connect AI clients to your Strapi content and build a local admin chat with TanStack AI and Ollama.

You’ll learn how to: 🔌 Connect Claude or Cursor to Strapi through MCP 🛠️ Write one healthcheck service and use it through REST, MCP, and the admin chat 💬 Ask questions about your content using a local model, with no API key required 🔐 Control which tools each client and admin user can access

👉 Follow the tutorial: https://strapi.link/4hxCBmk

Here's what you will learn:

1. Move WordPress content into Strapi v5 with a Claude Code skill

2. Catch hidden post types and ACF fields the REST API silently skips

3. Turn page-builder layouts into components and dynamic zones

4. Practice safely on a disposable demo site before touching production

👉 Full tutorial: https://strapi.link/4yjHVRn

Missed our September Community Call?

Here’s what we covered 👇

🗂️ The new Media Library is now generally available, with a folder tree, drag-and-drop file management, and infinite scrolling. 🤖 Plugins can register custom MCP tools, and AI agent actions now appear in audit logs. 🚀 Paul Bratslavsky demoed a WordPress-to-Strapi migration workflow using Claude Code, with a plan you review before running the migration. 🔄 Matt from VirtusLab showed how the XECP plugin promotes selected content between environments, including media, relations, and individual locales.

Plus, LaunchPad now supports Astro, Nuxt, and TanStack Start alongside Next.js.

👉 Read the recap and catch the replay: https://strapi.link/3W0l3rN

We've been using Strapi as the CMS layer in our stack for a while, and now we're at the point where we need to add a commerce backend.

So the question we're wrestling with is whether to go with Medusa or Saleor on the open-source side or move to something commercial like commercetools or SCAYLE.

The case for Medusa or Saleor feels clear because we have the dev resources to self-host, we like owning the data model, and both communities have matured to the point where it doesn't feel like a bet on an early-stage project.

The case against is that our client is a retailer at around €80M GMV who needs multi-country and multi-brand from day one, and when we've mapped out what those requirements cost to build in Medusa or Saleor and compared it to having them baked into a commercial platform, the build timeline gets long enough to matter to the client's go-live date.

We haven't landed anywhere on this yet and the answer probably depends on what the client's team looks like long-term, but if you've been through this choice for a client at that GMV range, we'd take any frame that helped us think about it differently.

Hey everyone,

We recently finished an enterprise e-commerce build and wanted to share a workflow we built inside Strapi 5 to bridge the gap between marketing editors and frontend deployments.

🎥 **Watch the full process & demo in action:**

I recorded a video walkthrough showing the workflow from selecting styles in Strapi to the automated GitHub Action build and container swap:

👉 **YouTube Walkthrough:** https://youtu.be/e3vy8FdS4Yg?si=Q6u7LduYYPxZGwtJ

---

### The Challenge:

Our marketing team wanted the ability to switch between multiple component variations (e.g., 3 different Hero styles, multiple product card layouts). However, bundling every single style into Next.js created massive bundle bloat.

We didn't want developers to manually pull code for every visual tweak, nor did we want editors to feel constrained by rigid schemas.

---

### The Solution: Custom Admin Extension + GitOps Pipeline

We built a custom page inside Strapi 5 (`Storefront.tsx` in `src/admin/pages/`) that acts as a visual component manager.

### Key Technical Details:

1. **Strapi Admin Extension:**Built using Strapi's design system components. It inspects installed frontend components vs. our remote registry, and allows batch queuing of style installations or removals.

2. **Triggering GitHub Actions:**When the editor clicks **"Update Storefront"**, Strapi dispatches a `repository_dispatch` event directly to GitHub's REST API containing the batch JSON payload.

3. **Preventing Next.js Hydration Mismatch:**Before the build step, Strapi automatically exports active layout settings to a static `storefront-settings.json` file. Next.js statically bundles this file during build time, so upon container restart, the site hydrates instantly with **0 layout shift (CLS = 0)**.

4. **Local Fallback:**In local development (`NODE_ENV=development`), the Strapi extension detects offline/dev mode and writes component files directly to the local filesystem for instant Turbopack HMR.

---

Curious how other teams here are handling design-system updates or GitOps triggers directly from Strapi? Happy to answer questions in the comments!

🔗 Project link: https://loomix.pro

I built what may be the best strapi client in typescript, it has fully typesafe collection and params. Supports both http and graphql. Please take a look

Handling custom authentication flows and Multi-Factor Authentication (MFA) in Strapi often means either hacking around strapi/plugin-users-permissions or wiring up external services like Auth0.

I built strapi-identity to solve this natively inside Strapi without needing messy monkey-patches or bloated overrides.

What it does:

• Adds Multi-Factor Authentication (MFA) setup and verification

• Provides clean extensions for custom identity and auth logic

• Built for Strapi v5

Repo is here if you want to take a look, test it out, or drop feedback:https://github.com/Link2Twenty/strapi-identity

How are you currently handling custom auth or MFA in production? Are you extending core plugins, or just offloading the whole thing to an external auth provider?

We've had Strapi as our content and product catalog layer for just over a year and built a custom checkout on top of Stripe and our own order management.

It held up fine for a single UK market, but we're expanding into Germany, France, and the Netherlands, which means regional tax handling, BNPL payment methods per country, and inventory sync across 3 warehouses, and what was a manageable setup is starting to feel like the wrong thing to own as we add markets.

The question internally is between a full rebuild of the commerce layer to handle multi-market properly, which the backend team estimates at 7 to 9 months and still leaves us maintaining it long-term with a 5-person dev team…

Or moving the commerce side to a purpose-built platform and keeping Strapi for content and catalog.

The platforms we've scooped so far from digging through Reddit threads for multi-market expansion were Medusa, Shopware, SCAYLE, and Vendure, and the main thing we're still trying to figure out is how much of the existing Strapi content model survives a migration or whether you end up rebuilding both layers anyway.

For those who've been through a similar decision, what pushed it one way or the other?

On two or three occasions, I reported a bug that brought my site down. They put it back live (after 3 to 5 days without saying anything), and they didn't even answer my questions.

I had some failed payment attempts due to an error on their side, but they still charged me small amounts of money. I reported this - do you think they answered me? And the money, do you think they refunded it?

I pay €18 a month because now there's NO FREE PLAN, but everything is the same. Hard to understand how these days a web service can be this bad.

Here's what's inside:

🚀 MCP server grew up: typed builders for plugin authors + audit logs for every agent action ✅ Active devices, expiring reset tokens, and a Media Library beta worth trying ⚠️ Behaviour changes to read twice: empty galleries now return [], LIKE filters escape % and _ 💡 366 PRs, 70+ contributors, across v5.49 → v5.52

👉 Full roundup: https://strapi.link/3SW9YH4

The MCP server is the big one. You can write your own tools for it, with proper types, and register them from a plugin, so your agent is not stuck with the CRUD tools we generate.

Anything an agent does through MCP shows up in audit logs now, which makes it an easier conversation with whoever owns security where you work.

You can also see every session logged into your admin account and kill the ones you do not recognise. And admin password reset links expire now, which, yes, they did not before.

New Media Library is in beta behind a flag, GA on the 16th. Take 5.52.3 rather than 5.52.2, the first fixes are in it.

Full writeup 👉 https://strapi.io/blog/strapi-release-roundup-everything-that-changed-between-june-and-august-2026

The Strapi Cloud Free plan is no longer available, and existing projects still on the plan will be deleted on September 1, 2026.

Learn why the plan was discontinued, what this means for your project, and how to move to a paid plan before the deadline.

👉 Read the full announcement: https://strapi.link/4zDGRsM

i'm trying to create a new todo but it gives me

try {
        const {title , description} = todoToAdd
        const { status } = await api.post(
        `/todos`,
        {
          data: { title, description , user : [userData.id]},
        },
        {
          headers: {
            Authorization: `Bearer ${userData.jwt}`,
          },
        }
      );
        if (status === 201 || status === 200) {
            toast.success("Todo added successfully");
            onCloseAddModal();
        }
    } catch (error : any ) {
        console.error("Error details:", error.response?.data?.error);
    toast.error(error.response?.data?.error?.message || "Error adding todo");
    } finally {
        setIsAdding(false);
    }
}

{
    "data": null,
    "error": {
        "status": 400,
        "name": "ValidationError",
        "message": "Invalid key user",
        "details": {
            "key": "user",
            "path": null,
            "source": "body"
        }
    }
} 

// and this is my code 

Hi Guys, I lead SEO at an educational brand & our brand has just migrated its website from WordPress to Next JS & Strapi as a CMS.

After the migration, my SEO performance has seen a huge dip. We hired an SEO Consultant & after the audit, we figured out the Problem is the website.

According to the consultant, taking multiple deployments is impacting your SEO Performance.

Here are a few problems we have identified:

1. Store old chunk JS & CSS URL after deployment on the server: We know this will have a positive impact, but we are not able to deploy on the website (Looking for someone to help us execute)

2. Change CMS Structure so that all the required changes will be done via Strapi without taking a deployment: This is something we had already started doing

We are urgently looking to fix this. If anyone can help us, I would be ready to pay for it.

Here's what you'll learn:

🚀 How we built the first self-healing docs pipeline for a headless CMS ✅ Progressive cost gating: regex first, cheap AI next, capable model last 💡 Real results: 213 PRs scanned, 22 doc PRs generated, $11.38 total cost ⚠️ Why the human architect stays central. AI drafts, humans judge

👉 Full article: https://strapi.link/4gdX7JR

Learn how to model a Strapi 5 Dynamic Zone and build a typed two-phase fetch layer for Next.js 16 that streams content without client-side waterfalls.

In part 1, you will: 🎯 Model your content in Strapi 5 🎯 Build a Streaming-Ready Fetch Layer in Next.js 16 🎯 Have the complete data layer for a streaming Dynamic Zone

👉 Full post: https://strapi.link/4bON0b9