erroneo.us
Search all guides⌘K

Security Digest · Oct 21, 2026 · Vulnerability · Language runtime

Node.js October 2026 Security Releases: 10 CVEs Fixed

Node.js 22.23.4, 24.22.1 and 26.12.1 fix a Brotli out-of-bounds write, TLS hostname bypasses and more. Not known exploited. Upgrade this week.

Published By erroneo.us Security Desk3 min read4 sources

Our verdict

Patch this week

Four high-severity fixes, including a Brotli decoder memory-corruption bug the project says permits remote code execution, make this a routine-but-real upgrade: roll every supported line forward this week.

Who must act: Anyone running Node.js 22.x, 24.x or 26.x in production, especially services that decompress untrusted Brotli data or make TLS connections to hosts given as IP addresses.

Who can relax: Nobody needs to drop everything today: no exploitation is reported, and the low-severity Permission Model and ZIP fixes only matter if you use those features.

Affected
Node.js 26.x before 26.12.1
Node.js 24.x before 24.22.1
Node.js 22.x before 22.23.4
All End-of-Life Node.js lines (per the Node.js project)
Fixed in
Node.js 26.12.1 (Current)
Node.js 24.22.1 (LTS)
Node.js 22.23.4 (LTS)
CVSS
Not scored
EPSS
Not yet scored
CISA KEV
Not listed
Exploitation
No known exploitation
Severity
High

What to do

  1. Check every runtime that serves traffic: node -v in each container, VM and CI image.
  2. Upgrade to 26.12.1, 24.22.1 or 22.23.4 (nvm install 24.22.1, or your package manager / official node:* images), then restart processes.
  3. Rebuild and redeploy container images and single executable applications (SEAs) so they embed the fixed runtime.
  4. Move anything still on an End-of-Life line (20.x or older) to a supported LTS; EOL lines are always affected.
  5. Rebuild startup snapshots and SEAs that use crypto.randomUUID() or crypto.randomInt(), so each process gets fresh entropy.

How to check if you are affected or compromised

  • Run node -v (and node -p process.versions) on hosts and inside images; anything below the fixed versions is affected.
  • Scan image registries and SBOMs for older node binaries, including base images pinned by digest.
  • Look for unexplained Node.js process crashes while handling compressed (br) request or response bodies.

What happened#

On October 21, 2026 the Node.js project shipped security releases for every supported line: 26.12.1 (Current), 24.22.1 (LTS) and 22.23.4 (LTS). The releases fix ten CVEs. Four are rated high, three medium and three low. They also pull in dependency updates for c-ares, OpenSSL, SQLite and Undici, plus a root-certificate change after the compromise of an eMudhra intermediate CA.

The four high-severity issues:

  • CVE-2026-111497: an out-of-bounds write in the bundled Brotli decoder. The project's own title says it "permits remote code execution". The fix is a cherry-picked upstream Brotli patch. It affects 26.x, 24.x and 22.x.
  • CVE-2026-106069: a TLS certificate hostname check bypass when the host loosely resolves to an IP address. It affects 26.x, 24.x and 22.x and is fixed together with the medium-rated CVE-2026-106072, under which DNS names in a certificate could authenticate a non-canonical IPv4 endpoint. Per the 24.22.1 notes, TLS now rejects non-canonical IP addresses.
  • CVE-2026-105483: another TLS hostname bypass, this time when an IP address is written in fullwidth digits. It is listed as an IP normalization regression and affects 26.x and 24.x only.
  • CVE-2026-105482: dns.resolve truncated names containing a NUL character. It affects all three lines.

The medium fixes cover a keep-alive socket processing a response written before its request was sent (CVE-2026-105481). The other one, CVE-2026-106074, is easy to miss. crypto.randomUUID() and randomInt() entropy caches were saved into user-land startup snapshots and single executable applications, "so every process repeats the same values." The low fixes are two Permission Model bypasses (CVE-2026-106071 and CVE-2026-106073) and a ZipFile prefix-bytes issue on 26.x (CVE-2026-106070).

Who is affected#

Anyone running Node.js 22.x, 24.x or 26.x before the fixed versions is affected. The project notes that End-of-Life lines "are always affected when a security release occurs" and get no fix, so anything on 20.x or older should move to a supported LTS. That also covers Node.js bundled into container images, desktop apps and SEAs, which only get the fix when they are rebuilt.

Do you really need to act?#

Yes, on a normal patch cadence. No exploitation is reported, none of these CVEs is in CISA KEV, and the project published no CVSS scores, only severity ratings. Priority depends on what your services do:

  • Brotli (CVE-2026-111497) matters most if your code decompresses Brotli data an attacker can influence, for example br-encoded bodies or files decoded with the zlib Brotli APIs. Memory corruption in a parser that handles network input is the one item here that could become serious fast.
  • The TLS hostname issues matter for clients that connect to hosts named by IP address, or that accept attacker-influenced hostnames, such as webhooks, URL fetchers and proxies. The risk is a certificate being accepted for the wrong endpoint, which helps an attacker already positioned on the network path.
  • Snapshot/SEA entropy (CVE-2026-106074) matters only if you build startup snapshots or SEAs. Then every process could hand out the same "random" UUIDs, which is bad for anything that uses them as identifiers or tokens.
  • Permission Model fixes matter only if you rely on --permission as a sandbox.

What to do now#

  1. Inventory runtimes: run node -v on hosts, in CI runners and inside images (docker run --rm your-image node -v).
  2. Upgrade: nvm install 24.22.1 (or 22.23.4 / 26.12.1), your OS package manager, or refreshed official node:* images. Then restart every Node process.
  3. Rebuild and redeploy images, Electron-style bundles you control, and SEAs. Restarting an old image does not patch it.
  4. If you ship startup snapshots or SEAs that call crypto.randomUUID() or crypto.randomInt(), rebuild them on a fixed release. Review whether any identifiers they generated were relied on to be unique or secret.
  5. Plan migration off any End-of-Life line.

How to tell if you were hit#

There is no public exploitation to hunt for. The practical check is exposure. Compare node -p process.versions.node against the fixed versions across your fleet and image registry. As a weak signal for the Brotli bug, look for Node processes crashing while handling compressed traffic. If you shipped snapshot-based binaries, check logs or databases for duplicate UUIDs generated by different processes. That pattern is the visible symptom of CVE-2026-106074.

Timeline#

  • — The Node.js project publishes its October security release advisory. Node.js 26.12.1, 24.22.1 and 22.23.4 are released the same day with fixes for ten CVEs.

Vulnerability records

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Node.js — Wednesday, October 21, 2026 Security Releases nodejs.org
  2. Node.js — Node.js 24.22.1 (LTS) release notes nodejs.org
  3. Node.js — Node.js 22.23.4 (LTS) release notes nodejs.org
  4. Node.js — Node.js 26.12.1 (Current) release notes nodejs.org