Node.js October 21, 2026 security releases: four HIGH bugs in 26.x, 24.x and 22.x
Node.js shipped 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing 10 CVEs. The four HIGH ones are a Brotli decoder out-of-bounds write that can lead to remote code execution, two TLS certificate hostname bypasses, and dns.resolve truncating names that contain a NUL byte. Any app running its own Node process should upgrade.
What it is
HIGH: CVE-2026-111497, the Brotli decoder (used by zlib and HTTP decompression) can write out of bounds, which the Node.js project says permits remote code execution. Affects 26.x, 24.x and 22.x.
HIGH: CVE-2026-106069 (26.x, 24.x, 22.x) and CVE-2026-105483 (26.x, 24.x) let a TLS certificate pass hostname checks when the host is written as a loosely parsed IP address or with fullwidth digits. The fix makes TLS reject non-canonical IP addresses.
HIGH: CVE-2026-105482, dns.resolve truncates names containing a NUL character, so the name that gets resolved can differ from the one your code validated. Affects 26.x, 24.x and 22.x.
MEDIUM: CVE-2026-105481 (keep-alive socket can process a response written before the request was sent), CVE-2026-106072 (DNS SANs can authenticate non-canonical IPv4 endpoints) and CVE-2026-106074 (crypto.randomUUID() and randomInt() caches saved into startup snapshots and single executable apps, so every process repeats the same values).
LOW: CVE-2026-106070 (ZipFile prefix bytes, 26.x), CVE-2026-106071 (Permission Model wildcard over-grant, 26.x) and CVE-2026-106073 (Permission Model bypass with fs.realpathSync).
The release also updates bundled c-ares, root certificates (eMudhra intermediate CA compromise), OpenSSL (24.x, 22.x), SQLite (22.x) and undici. End-of-life lines (20.x and older) get no fix and should be treated as affected. As of October 21, 2026 these CVEs are not yet on NVD, so there are no NVD scores; severities here are the Node.js project's own.
How to check
- Run node -v locally, in CI and inside your Docker image. Anything below 22.23.4, 24.22.1 or 26.12.1 on those lines, or any 20.x or older, needs updating.
- Check what pins your version: .nvmrc, the engines field in package.json, the FROM line of your Dockerfile, or the NODE_VERSION variable on Netlify and similar hosts.
- Vercel: its docs say only the major version is selectable and it rolls out minor and patch updates itself when a security fix needs it. Replit, Railway, Render, Fly.io and your own VPS or container run whatever version you installed or pinned, so check those.
How to fix
- Upgrade to Node.js 22.23.4, 24.22.1 or 26.12.1, then redeploy and restart every long-running Node process.
- Rebuild Docker images from an updated base (for example node:24 or node:22 after the new tags are published) instead of reusing a cached layer.
- If you are on Node 20 or older, move to 22.x or 24.x. They are the supported LTS lines.
- If you build single executable apps or user-land startup snapshots, rebuild them on the fixed version so random values are no longer repeated across processes.
# Which Node is running here (repeat in CI and in your container)
node -v
docker run --rm <your-image> node -v
# Where is the version pinned?
cat .nvmrc 2>/dev/null; grep -n '"node"' package.json; grep -n '^FROM' Dockerfile 2>/dev/null
# Upgrade (nvm example), then redeploy
nvm install 24.22.1 # or 22.23.4 / 26.12.1
nvm alias default 24.22.1
echo 24.22.1 > .nvmrc