Node.js releases on October 21, 2026 a security advisory for 22.x, 24.x, 26.x release lines 2026 October 21 The Node.js project has rolled out updates on October 21, 2026, for the 22.x, 24.x and 26.x release lines.
The updates fix a number of flaws that impact network communication, certificate validation, data processing, and permissions. The list of elevated-priority flaws include an issue in the Brotli decoder that can lead to remote code execution.
The revised versions are Node.js 22.23.4, 24.22.1 and 26.12.1. If you are a developer or a server administrator using one of the affected versions, consult the security advisory and upgrade to the correct fixed version.
Node.js Security Updates Correct for Various Flaws
The new version of Node.js is a security update that fixes several vulnerabilities, rated high, medium and low severity. The flaws impact various areas of the runtime and the severity of risk varies based on the application, its configuration and usage of the impacted functionality.
The most serious issues are issues in the Brotli decoder, DNS input handling and TLS certificate hostname validation. The update also resolves problems with HTTP connections, cryptographic randomness and permission checks.
In addition to these patches, the project has also upgraded a number of dependencies such as the certificate authorities, c-ares, OpenSSL, SQLite, and Undici. The dependent updates differ for each Node.js release line.
Key Vulnerabilities Covered in the Release
There are multiple issues in Node.js 22.x, 24.x and 26.x security advisories, which are contained in the list below. The October 21 release addresses the following issues.
Brotli Decoder Faults
CVE-2026-111497 | High severity
The vulnerability is in the Node.js Brotli decoder and an out-of-bounds write has been identified that may result in remote code execution.
Brotli is a compression algorithm that decreases data size. A flaw in its decoder could lead to a security vulnerability when specially crafted input is processed by the impacted code. In the situation that it happens, attacker can compromise the impacted process by executing code.
As per the provided advisory information, the impact of the reported vulnerability would be on Node.js 22.x, 24.x and 26.x.
DNS Resolution and Validating Input
CVE-2026-105482 | High severity
This is a dup to dns.resolve() truncating names with null characters. Inappropriate handling of input can result in a hostname being evaluated differently from the expectation of the application.
These anomalies may pose security issues for applications which use DNS resolution for name identification or name contacting of other systems. The bug has been confirmed on all three release lines which are affected as listed in the announcement.
TLS Certificate Validation Weaknesses
CVE-2026-105483 and CVE-2026-106069 | High severity
Updates address two vulnerabilities related to hostname validation in TLS certificate validation.
One is malicious IP addresses presented in fullwidth digits. Another is when hostnames ambiguously match with an IP address. In both cases, if hostname validation doesn’t work as expected, the application could connect to a different endpoint and be susceptible to impersonation.
Number included in the Scope of the problem The components in scope are: CVE-2026-105483 (Node.js 24.x, 26.x) CVE-2026-106069 (Node.js 22.x, 24.x, 26.x)
Additional HTTP, Cryptography, and Permission Fixes
Additionally, the security update fixes the following medium- and low-severity vulnerabilities:
- CVE-2026-105481: An HTTP keep-alive socket race where responses are written before the request is sent.
- CVE-2026-106072: Certificate validation bypass with non-canonical IPv4 hostnames.
- CVE-2026-106074 – Cryptographic randomness caches that are kept in startup snapshots could lead to the same value being used across multiple processes.
- CVE-2026-106070 – Zip File validation bug in Node.js 26.x.
- CVE-2026-106071: Filesystem permission over-grant in Node.js 26.x versions.
- CVE-2026-106073: Fs.realpathsync() “Permission Model Bypass” vulnerability that is present in all three release lines.
The flaws are to be found in various pieces of runtime, thus the peril is different in various applications and configurations. Applying the vital safety refreshes will secure the inspected shortcomings, regardless of whether an application appears to work fine.
Which Node.js Versions Should Be Updated?
The project has published the following fixed versions:
| Release line | Fixed version | Release status |
|---|---|---|
| Node.js 22.x | 22.23.4 | Long-Term Support (LTS) |
| Node.js 24.x | 24.22.1 | Long-Term Support (LTS) |
| Node.js 26.x | 26.12.1 | Current |
It is recommended that your administrators apply the fixed version, or a supported security release, that is appropriate for the impacted module. Not all vulnerabilities contained in each update are necessarily present; refer to the advisory for details.
Additionally, the Node.js project specifies that end-of-life versions may still contain security vulnerabilities until security updates are made to active branches. If upstream security updates are not released for an end-of-life version, that version may require a migration to a supported release.
What Developers and Server Administrators Should Do
Check the Node.js version in each environment The version you have installed in a system can be found by executing:
node -v
Test your output against a fixed release for your major version. Before you migrate to production, test application compatibility, dependencies and your important workloads in a stage environment where possible.
Select all environments that you run Node.js on, including production servers, containers, workstations, and CI/CD pipelines. Upgrading your local development environment will not mitigate the risk on a different production server still running the vulnerable version.
For containerised applications, update the relevant base image or runtime image and rebuild affected containers and redeploy them where appropriate. Take another look at deployment procedures if your team deploys existing images to avoid inadvertently reintroducing an outdated, vulnerable runtime.
What Node.js Users Should Do Next
How to install these updates How you install these updates will vary, depending on the deployment of Node.js and whether you are managing the runtime.
For BigCloudy shared hosting customers: BigCloudy has applied the necessary remediation to its shared hosting environment. If you use BigCloudy to run your Node.js environment and deploy your app, then please contact support or check your hosting documentation to determine if you need to take any further steps.
For static websites exported using Next.js, Astro or Vite, a Node.js process is usually not needed on the production server if the output is only static files. Node.js installations may be required in the development and build environment so check the individual installer pages.
If you host Node.js on your VPS or hosting service: Upgrade to the fixed release: 22.23.4, 24.22.1 or 26.12.1 depending on your major version in support, then restart all Node.js services to use the new runtime.
You are using an end-of-life version. Moving to a supported release You need to migrate to a supported release. These are end-of-life versions: update your container image to a fixed Node.js release, rebuild your image and redeploy your application.
For version-specific info, refer to the security releases of Node.js and the fixes being provided.
Final Call
The October 21 security release for Node.js 22.x, 24.x and 26.x patch several security holes with Node.js, including issues with high-severity Brotli decoding, DNS resolution and TLS certificate validation. Updating to the correct release version prevents versions of the runtime from being exposed to these actively exploited vulnerabilities. Look at the environment where your deployment happens and ensure the runtime is tested.
