Node.js has released security updates for its 26.x, 24.x and 22.x lines, fixing ten vulnerabilities across DNS, TLS, HTTP, crypto and the Brotli decoder. The patched versions are 26.12.1, 24.22.1 and 22.23.4, released Wednesday, October 21, 2026. Four of the ten flaws are rated high severity, and the most serious — a Brotli decoder flaw that permits remote code execution — affects every supported release line. If you run Node.js anywhere it handles live traffic, update now.
The short version
On October 21, 2026, the Node.js project published coordinated security releases covering all three supported release lines. The update fixes ten CVEs: four high, three medium and three low. The highest-severity issue in every branch is high; nothing in this release is rated critical.
The fixes you need: 26.12.1 for the 26.x line, 24.22.1 for the 24.x line, and 22.23.4 for the 22.x line. After updating, rebuild any container images, restart your services, and confirm every environment is actually running the patched runtime. Unsupported versions — including Node.js 20 and 18, which are now past end of life — are affected and will not receive fixes. The project’s standing warning applies: end-of-life versions are always affected when a security release occurs.
Here is the full list of what was fixed.
All ten vulnerabilities, explained
CVE-2026-111497: Brotli decoder out-of-bounds write (High)
This is the flaw that tops the advisory. Node.js’s Brotli decoder can write data outside its intended memory area, which the advisory says permits remote code execution. Brotli is the compression algorithm your browser negotiates with most web servers, so any Node.js process that decodes Brotli data an attacker can influence — a request body, an uploaded file, a fetched response — is in the danger zone.
What makes this one particularly unpleasant is that the attack surface is broad. You do not need to call the Brotli API directly; a dependency that transparently decompresses responses can pull you in. It affects 26.x, 24.x and 22.x alike. The flaw was reported by OpenAI Codex Security researchers Khai Tran and Sylvie Mayer.
CVE-2026-105483: TLS hostname check bypass with full-width digits (High)
When a Node.js application opens an HTTPS connection to an IP address written with full-width (Unicode) digits, the TLS hostname verification could be bypassed. That breaks a core assumption: your app thinks it is talking to the server it intended, but the certificate check that guarantees that may not hold. This matters most for backends that make HTTPS calls to other services. It affects 26.x and 24.x.
CVE-2026-106069: TLS hostname check bypass on loose IP resolution (High)
A second, distinct way around TLS hostname verification: hostnames that loosely resolve to an IP address could pass the check when they should not. Like the flaw above, it undermines the identity guarantee of TLS for apps making outbound HTTPS requests. It affects all three lines: 26.x, 24.x and 22.x.
CVE-2026-105482: dns.resolve NUL-byte truncation (High)
Node.js’s dns.resolve truncated DNS names containing a NUL character. Anything downstream that depends on the name being handled consistently — allow-list checks, routing decisions, security policy enforcement — can be tricked when the name it sees is shorter than the name that was actually looked up. It affects 26.x, 24.x and 22.x.
The three medium-severity flaws
CVE-2026-105481 is an HTTP keep-alive issue: a socket could process a response that was written before its request was sent, breaking request-response ordering on reused connections. CVE-2026-106072 is another certificate validation problem — improper validation for nonstandard IPv4 hostnames lets DNS certificate names authenticate IP endpoints. CVE-2026-106074 is a cryptographic hygiene issue: cached random data stored in startup snapshots and single-executable applications can cause repeated values from crypto.randomUUID() and crypto.randomInt(), which are supposed to be unpredictable.
The three low-severity flaws
CVE-2026-106070 (26.x only) is a ZIP validation failure that exposes attacker-controlled bytes after failed header checks. CVE-2026-106071 (26.x only) lets wildcard matching grant excessive filesystem access through the Permission Model. CVE-2026-106073 (26.x, 24.x, 22.x) bypasses Permission Model checks through fs.realpathSync.
The eMudhra CA removal
Buried in the release notes is something with wider significance than any single CVE. This release updates the bundled CA certificate list to pull out the compromised eMudhra intermediate CAs. Earlier this month, weak eMudhra CA keys were blocked by Chrome, Firefox and Apple after a researcher found improperly generated keys from a 2025 key ceremony. Node.js removing those intermediates from its trust store means connections chained to them will no longer be trusted by patched runtimes. If you have seen certificate validation errors lately in a Node.js application, this is likely the reason.
Dependency updates included
The release also refreshes bundled dependencies: c-ares on all three lines, the CA certificate list on all three, Undici on all three, OpenSSL on 24.x and 22.x, and SQLite on 22.x. If you pin or audit dependency versions for compliance, those are the ones that moved.
Who is affected — and who is not
You are exposed if you run Node.js where it touches untrusted network input: APIs, backends, server-rendered sites, serverless functions, Electron desktop apps (which bundle their own Node.js), and anything in a Docker image with a Node.js base layer. If your project only uses Node.js as a build tool to produce static pages, your exposure is much smaller — but you should still move off end-of-life versions.
Two notes that often get missed. First, updating Node.js does not update your application dependencies — earlier this month’s Next.js RCE fixes were a separate release, and the same principle applies to your own package tree. Second, Node 18 and Node 20 are past end of life and get nothing. The only fix for those lines is to upgrade to a supported one, or to pay for commercial extended support as a stopgap.
How to patch
Start by finding out what you run. Check node -v on every server, not just the ones you remember. Then:
- nvm users:
nvm install 24.22.1(or the matching version for your line) and switch your processes over. - Package managers:
apt upgrade nodejsor your distro’s equivalent, then verify withnode -v. - Docker: rebuild your images against the patched base tag, for example
node:24.22.1-bookworm-slim, push, and redeploy. Layer-cached builds will not pick up the fix on their own. - Serverless and PaaS: check your provider’s runtime version and redeploy if it is behind. Some platforms apply patch updates automatically; most do not.
- Electron apps: update the framework dependency in your app and ship a new build.
- Hosting panels and selectors (CloudLinux alt-nodejs and similar): apply the updated packages through your panel.
After updating, restart every affected service and confirm the running version — the patch only counts once the patched binary is actually in memory. Then exercise your outbound HTTPS paths, DNS handling, compressed-content handling and any permission-restricted workloads in staging before you call it done.
October 21 was a heavy day
The Node.js release landed on one of the busiest security days of the year. Hours earlier, PHP shipped an emergency release for the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619), two critical remote code execution vulnerabilities that prompted organizations worldwide to check their exposure and in some cases take sites offline. Apache Tomcat also pushed fixes for eight vulnerabilities, and Node.js’s own notes landed alongside fresh certificate-trust fallout from the eMudhra incident.
That clustering is not a coincidence you can plan for. It is a reminder that the runtime underneath your application — the language, the web server, the compression library — is part of your attack surface whether you think about it or not. Patch windows for infrastructure like PHP, Node.js and Tomcat deserve the same urgency as application updates, because the next PHP2Shell is always one disclosure away.
What to do this week
- Inventory every place Node.js runs in your stack: servers, containers, CI runners, build images, Electron apps.
- Update to 26.12.1, 24.22.1 or 22.23.4 as appropriate, rebuild images, restart services.
- Verify
node -vin production, not just in your repo. - Move anything on Node 18, 20 or older to a supported line.
- Subscribe to the nodejs-sec mailing list or the official security announcement so the next one does not catch you by surprise.
Frequently asked questions
Which Node.js versions fix the October 2026 vulnerabilities?
26.12.1 for the 26.x line, 24.22.1 for the 24.x line, and 22.23.4 for the 22.x line. Install the version that matches the line you run.
Is the Brotli flaw really exploitable over the network?
The Node.js advisory describes CVE-2026-111497 as an out-of-bounds write in the Brotli decoder that permits remote code execution. It affects any process that decodes Brotli data an attacker can influence. The advisory does not spell out the exact conditions, so treat any exposed Brotli-decoding path as at risk.
Do I need to patch if my site only uses Node.js to build static pages?
Your exposure is much lower, but you should still update, and you must leave end-of-life lines. Node 18 and 20 receive no security fixes at all.
Will updating Node.js fix my dependencies too?
No. Updating the runtime does not update application packages like Next.js, Express or your transitive dependencies. Patch those separately with your package manager.
Why did my app start failing certificate checks after updating?
Possibly the eMudhra change. This release removes the compromised eMudhra intermediate CAs from Node.js’s bundled trust store. Certificates chained to them are no longer trusted. Check whether your servers or clients rely on eMudhra-issued certificates.
What if I cannot update right away?
Prioritize anything internet-facing and anything that decodes untrusted Brotli content or makes outbound HTTPS calls. If you are stuck on an end-of-life version, commercial extended-support vendors can provide backported fixes while you plan the upgrade. There is no supported way to stay on Node 18 or 20 safely.