Patched: you run official upstream Node.js 22.23.4, 24.22.1 or 26.12.1, or a later release in the same line, and the process restarted after the upgrade. Unpatched: official upstream builds below those versions. Not an upstream build: if your Node.js comes from a Linux distribution, a base image, a managed runtime or another vendor, check that vendor's own advisory. Vendors can backport fixes without changing the version number, so the version string alone doesn't settle it. Node.js 18, 20 and 25 are not among the three lines the post covers, and the post says end-of-life versions are always affected by security releases.1 That means those lines get no fix from this release. It doesn't mean every CVE below is reachable on them, and I haven't tested them against each one. Whether a given CVE reaches your code is a separate question, and the table answers it. Confidence: high on the CVE list, severities, affected lines and fixed versions, which I read on nodejs.org and in the release notes. Medium on practical exposure, because that column is my reading of each description and depends on your code and platform. Status as of 4 November 2026.
Node.js fixed ten vulnerabilities on 21 October 2026: four High, three Medium and three Low.1 Which of them apply depends on your line. By my count from the post's affected lines, all ten apply to 26.x, eight to 24.x and seven to 22.x.1 Only the Brotli flaw, CVE-2026-111497, is listed as exploited, and I found no exploitation reports for the other nine.2 Upgrade to 22.23.4, 24.22.1, 26.12.1 or a later release in your line today. Node.js has also scheduled another security release for 11 November or shortly after, with no details published yet.3
The complete PHP2Shell and Node2Shell guide covers the Brotli flaw across ecosystems. This page covers all ten Node.js fixes and which ones your app can feel.
The ten fixes, with an exposure test for each
These are code-review clues, not exploitability tests. Actual exposure depends on the Node.js version, platform, application behavior and attacker control of the relevant input.
Reported The first four columns come from Node.js's own post. The last column is my reading of each description, not Node.js guidance.1
| CVE | What it is | Severity | Lines | Exposed if your app… |
|---|---|---|---|---|
| CVE-2026-105482 | dns.resolve*() and dns.reverse() cut names at a NUL byte | High | 26, 24, 22 | validates a hostname, for example against an allowlist, then resolves it with those functions, and the name can carry attacker-supplied text |
| CVE-2026-105483 | TLS hostname check bypass for IPv4 hosts written with fullwidth digits; a regression | High | 26, 24 | connects to IPv4 hosts whose text comes from outside your code, relies on certificate checks, and the server presents a certificate with a numeric DNS SAN (the post's examples: DNS:127.0.0.1, DNS:*.0.0.1) |
| CVE-2026-106069 | TLS hostname check bypass for leading-zero IPv4 hosts such as 0127.0.0.1 | High | 26, 24, 22 | connects to such hosts on a platform whose OS resolver reads leading zeros as decimal (the post names macOS), and the server at that address holds a certificate for the other address the string parses to under URL rules (87.0.0.1 for 0127.0.0.1) |
| CVE-2026-111497 | Brotli decoder out-of-bounds write: crash, memory disclosure or remote code execution | High | 26, 24, 22 | decompresses attacker-supplied Brotli data with node:zlib |
| CVE-2026-105481 | Keep-alive socket accepts a response written before the request | Medium | 26, 24, 22 | reuses HTTP Agent keep-alive sockets and can be busy with synchronous work |
| CVE-2026-106072 | A DNS SAN authenticates an IP endpoint for non-canonical IPv4 spellings | Medium | 26, 24, 22 | connects to spellings such as 0x7f.0.0.1 or 127.1; needs a numeric DNS SAN from a CA your client trusts and a platform resolver that accepts those spellings (the post names glibc) |
| CVE-2026-106074 | Entropy caches saved into snapshots and SEAs, so processes repeat values | Medium | 26, 24, 22 | builds user-land snapshots (--build-snapshot) or SEAs with useSnapshot, and calls crypto.randomUUID(), randomUUIDv7(), randomInt() or an API built on them, such as URL.createObjectURL(), while the snapshot is built |
| CVE-2026-106070 | zlib.ZipFile returns attacker-controlled bytes after a failed header check | Low | 26 only | reads zipEntry.modified on untrusted ZIP archives |
| CVE-2026-106071 | Permission Model wildcard grant allows paths it shouldn't | Low | 26 only | uses a wildcard --allow-fs-read or --allow-fs-write grant directly under the permission tree's root |
| CVE-2026-106073 | fs.realpathSync() skips Permission Model read checks | Low | 26, 24, 22 | runs under --permission with restricted --allow-fs-read |
The post doesn't map each CVE to a release. The release notes do. 22.23.4's notes list seven of the ten, which matches the post's 22.x affected list. 26.12.1's notes list nine, with the wildcard fix for CVE-2026-106071 appearing only as a commit, although the post's affected lines still put all ten on 26.x.45 I didn't open 24.22.1's notes, so the 24.x column rests on the post's affected lines.
The post credits the Brotli finding to OpenAI Codex Security, naming Khai Tran and Sylvie Mayer, and credits mcollina and aduh95 with the fix.1 It says nothing more about how the bug was found. BleepingComputer reports the flaw also affects HTTP servers and clients that rely on vulnerable Brotli implementations, and the Brotli flaw outside Node.js covers those.2
What to do first
Opinion This ranking is mine, and it covers what you'd feel first, not what you may skip. Every row that applies to your line ships in that line's patched release.
- CVE-2026-111497. It allows remote code execution, and CISA added it to its Known Exploited Vulnerabilities catalog on 27 October with a federal due date of 10 November.2
- The High DNS and TLS findings, if you resolve user-supplied names or connect to IP-addressed endpoints and rely on hostname checks.
- The Medium findings, by feature use: keep-alive reuse, numeric DNS SANs, snapshots and SEAs.
- The Low findings, only if you use
zlib.ZipFileor the Permission Model.
A pattern in the post
Reported At least four fixes follow earlier CVEs, in the post's own words. CVE-2026-105482 is an incomplete fix of CVE-2026-48930, CVE-2026-105483 is a regression introduced after the fix for CVE-2026-48618, CVE-2026-105481 is an incomplete fix of CVE-2026-48931, and CVE-2026-106073 is an incomplete fix of CVE-2026-21715.1 Opinion I read that as a reason to take every security release rather than skip one. The follow-ups sit in DNS, TLS, HTTP and permission code, where a first fix can miss a path.
Dependency updates
The post also lists updates to c-ares, the root certificate store, OpenSSL, SQLite and Undici, without CVE IDs. It labels the certificate update "eMudhra Intermediate CA Compromise" and says nothing more about it.1 The 22.23.4 notes show c-ares 1.34.9, OpenSSL 3.5.9, SQLite 3.53.4, Undici 6.29.1 and root certificates from NSS 3.131.1.4
Each line's patched release covers the fixes for that line
Upgrade. Don't pick fixes à la carte. The patched release for your line carries every fix that applies to it, and the ones you don't exercise cost nothing. A line the post doesn't cover gets no fix from this release: what to do on lines with no fix covers moving to a supported one.
Two details on versions. 26.13.0, released 28 October as the LTS cut of the 26 line, has no changes from 26.12.1 other than metadata.6 24.22.2, released the same day, lists V8 backports and a stream fix and no security items.7 Either is a safe target in its line.
What would change this verdict: a new regression in a fixed release, or the scheduled 11 November release superseding these versions. As of 3 November, Node.js says that release will cover 26.x, 24.x and 22.x, that the highest severity is High, and that details aren't published yet.3 It hasn't shipped as of this writing.
How you'd notice
You usually won't. Most of these produce no visible symptom until someone uses them. Opinion Treat these as leads, not proof: Node.js processes crashing or restarting after they receive Brotli-compressed input, and outbound connection targets written with leading zeros, hex or non-ASCII digits. A snapshot built before the upgrade carries the old random caches until you rebuild it.1 To confirm a patch, check the version of the running process, not the image tag. How to update and verify your Node.js version covers the check.
Upgrade, restart, then test the rows that matched
Do today
- List every Node.js runtime you operate: servers, containers, CI jobs, build images, SEAs.
- Upgrade each official upstream runtime to the patched release for its line (22.23.4, 24.22.1, 26.12.1 or later), then restart or redeploy and rebuild images.
- Check every distro-packaged, base-image or vendor-supplied Node.js against the vendor's own advisory, because its version string may not show the fix.
- Confirm the running version after the restart.
- Rebuild startup snapshots and SEAs with the fixed release.
Do this week
- Search your code for the features in the table:
dns.resolve, outbound TLS to IP-addressed hosts,useSnapshotand--build-snapshotbuilds,zlib.ZipFile, and--permissionflags. - Plan the move off any line the post doesn't cover.
- Reserve a patch window for the security release scheduled for 11 November.
Can wait
- Re-read the post when the 11 November release lands, and check whether any of these ten CVEs gains a public exploit.
Comments