‹ FeedCybersecurity
Cybersecurity

Node.js October 2026 Security Release: All 10 Fixes

Node.js shipped ten security fixes on 21 October. Here is what each one is, which release lines it touches, and the code that makes your app exposed.

7 min read

Patched: you run official upstream Node.js 22.23.4, 24.22.1 or 26.12.1, or a later release in the same line, and the process restarted after the upgrade. Unpatched: official upstream builds below those versions. Not an upstream build: if your Node.js comes from a Linux distribution, a base image, a managed runtime or another vendor, check that vendor's own advisory. Vendors can backport fixes without changing the version number, so the version string alone doesn't settle it. Node.js 18, 20 and 25 are not among the three lines the post covers, and the post says end-of-life versions are always affected by security releases.⁠1 That means those lines get no fix from this release. It doesn't mean every CVE below is reachable on them, and I haven't tested them against each one. Whether a given CVE reaches your code is a separate question, and the table answers it. Confidence: high on the CVE list, severities, affected lines and fixed versions, which I read on nodejs.org and in the release notes. Medium on practical exposure, because that column is my reading of each description and depends on your code and platform. Status as of 4 November 2026.

Node.js fixed ten vulnerabilities on 21 October 2026: four High, three Medium and three Low.⁠1 Which of them apply depends on your line. By my count from the post's affected lines, all ten apply to 26.x, eight to 24.x and seven to 22.x.⁠1 Only the Brotli flaw, CVE-2026-111497, is listed as exploited, and I found no exploitation reports for the other nine.⁠2 Upgrade to 22.23.4, 24.22.1, 26.12.1 or a later release in your line today. Node.js has also scheduled another security release for 11 November or shortly after, with no details published yet.⁠3

The complete PHP2Shell and Node2Shell guide covers the Brotli flaw across ecosystems. This page covers all ten Node.js fixes and which ones your app can feel.

The ten fixes, with an exposure test for each

These are code-review clues, not exploitability tests. Actual exposure depends on the Node.js version, platform, application behavior and attacker control of the relevant input.

Reported The first four columns come from Node.js's own post. The last column is my reading of each description, not Node.js guidance.⁠1

CVEWhat it isSeverityLinesExposed if your app…
CVE-2026-105482dns.resolve*() and dns.reverse() cut names at a NUL byteHigh26, 24, 22validates a hostname, for example against an allowlist, then resolves it with those functions, and the name can carry attacker-supplied text
CVE-2026-105483TLS hostname check bypass for IPv4 hosts written with fullwidth digits; a regressionHigh26, 24connects to IPv4 hosts whose text comes from outside your code, relies on certificate checks, and the server presents a certificate with a numeric DNS SAN (the post's examples: DNS:127.0.0.1, DNS:*.0.0.1)
CVE-2026-106069TLS hostname check bypass for leading-zero IPv4 hosts such as 0127.0.0.1High26, 24, 22connects to such hosts on a platform whose OS resolver reads leading zeros as decimal (the post names macOS), and the server at that address holds a certificate for the other address the string parses to under URL rules (87.0.0.1 for 0127.0.0.1)
CVE-2026-111497Brotli decoder out-of-bounds write: crash, memory disclosure or remote code executionHigh26, 24, 22decompresses attacker-supplied Brotli data with node:zlib
CVE-2026-105481Keep-alive socket accepts a response written before the requestMedium26, 24, 22reuses HTTP Agent keep-alive sockets and can be busy with synchronous work
CVE-2026-106072A DNS SAN authenticates an IP endpoint for non-canonical IPv4 spellingsMedium26, 24, 22connects to spellings such as 0x7f.0.0.1 or 127.1; needs a numeric DNS SAN from a CA your client trusts and a platform resolver that accepts those spellings (the post names glibc)
CVE-2026-106074Entropy caches saved into snapshots and SEAs, so processes repeat valuesMedium26, 24, 22builds user-land snapshots (--build-snapshot) or SEAs with useSnapshot, and calls crypto.randomUUID(), randomUUIDv7(), randomInt() or an API built on them, such as URL.createObjectURL(), while the snapshot is built
CVE-2026-106070zlib.ZipFile returns attacker-controlled bytes after a failed header checkLow26 onlyreads zipEntry.modified on untrusted ZIP archives
CVE-2026-106071Permission Model wildcard grant allows paths it shouldn'tLow26 onlyuses a wildcard --allow-fs-read or --allow-fs-write grant directly under the permission tree's root
CVE-2026-106073fs.realpathSync() skips Permission Model read checksLow26, 24, 22runs under --permission with restricted --allow-fs-read

The post doesn't map each CVE to a release. The release notes do. 22.23.4's notes list seven of the ten, which matches the post's 22.x affected list. 26.12.1's notes list nine, with the wildcard fix for CVE-2026-106071 appearing only as a commit, although the post's affected lines still put all ten on 26.x.⁠4⁠5 I didn't open 24.22.1's notes, so the 24.x column rests on the post's affected lines.

The post credits the Brotli finding to OpenAI Codex Security, naming Khai Tran and Sylvie Mayer, and credits mcollina and aduh95 with the fix.⁠1 It says nothing more about how the bug was found. BleepingComputer reports the flaw also affects HTTP servers and clients that rely on vulnerable Brotli implementations, and the Brotli flaw outside Node.js covers those.⁠2

What to do first

Opinion This ranking is mine, and it covers what you'd feel first, not what you may skip. Every row that applies to your line ships in that line's patched release.

  1. CVE-2026-111497. It allows remote code execution, and CISA added it to its Known Exploited Vulnerabilities catalog on 27 October with a federal due date of 10 November.⁠2
  2. The High DNS and TLS findings, if you resolve user-supplied names or connect to IP-addressed endpoints and rely on hostname checks.
  3. The Medium findings, by feature use: keep-alive reuse, numeric DNS SANs, snapshots and SEAs.
  4. The Low findings, only if you use zlib.ZipFile or the Permission Model.

A pattern in the post

Reported At least four fixes follow earlier CVEs, in the post's own words. CVE-2026-105482 is an incomplete fix of CVE-2026-48930, CVE-2026-105483 is a regression introduced after the fix for CVE-2026-48618, CVE-2026-105481 is an incomplete fix of CVE-2026-48931, and CVE-2026-106073 is an incomplete fix of CVE-2026-21715.⁠1 Opinion I read that as a reason to take every security release rather than skip one. The follow-ups sit in DNS, TLS, HTTP and permission code, where a first fix can miss a path.

Dependency updates

The post also lists updates to c-ares, the root certificate store, OpenSSL, SQLite and Undici, without CVE IDs. It labels the certificate update "eMudhra Intermediate CA Compromise" and says nothing more about it.⁠1 The 22.23.4 notes show c-ares 1.34.9, OpenSSL 3.5.9, SQLite 3.53.4, Undici 6.29.1 and root certificates from NSS 3.131.1.⁠4

Each line's patched release covers the fixes for that line

Upgrade. Don't pick fixes à la carte. The patched release for your line carries every fix that applies to it, and the ones you don't exercise cost nothing. A line the post doesn't cover gets no fix from this release: what to do on lines with no fix covers moving to a supported one.

Two details on versions. 26.13.0, released 28 October as the LTS cut of the 26 line, has no changes from 26.12.1 other than metadata.⁠6 24.22.2, released the same day, lists V8 backports and a stream fix and no security items.⁠7 Either is a safe target in its line.

What would change this verdict: a new regression in a fixed release, or the scheduled 11 November release superseding these versions. As of 3 November, Node.js says that release will cover 26.x, 24.x and 22.x, that the highest severity is High, and that details aren't published yet.⁠3 It hasn't shipped as of this writing.

How you'd notice

You usually won't. Most of these produce no visible symptom until someone uses them. Opinion Treat these as leads, not proof: Node.js processes crashing or restarting after they receive Brotli-compressed input, and outbound connection targets written with leading zeros, hex or non-ASCII digits. A snapshot built before the upgrade carries the old random caches until you rebuild it.⁠1 To confirm a patch, check the version of the running process, not the image tag. How to update and verify your Node.js version covers the check.

Upgrade, restart, then test the rows that matched

Do today

  1. List every Node.js runtime you operate: servers, containers, CI jobs, build images, SEAs.
  2. Upgrade each official upstream runtime to the patched release for its line (22.23.4, 24.22.1, 26.12.1 or later), then restart or redeploy and rebuild images.
  3. Check every distro-packaged, base-image or vendor-supplied Node.js against the vendor's own advisory, because its version string may not show the fix.
  4. Confirm the running version after the restart.
  5. Rebuild startup snapshots and SEAs with the fixed release.

Do this week

  1. Search your code for the features in the table: dns.resolve, outbound TLS to IP-addressed hosts, useSnapshot and --build-snapshot builds, zlib.ZipFile, and --permission flags.
  2. Plan the move off any line the post doesn't cover.
  3. Reserve a patch window for the security release scheduled for 11 November.

Can wait

  1. Re-read the post when the 11 November release lands, and check whether any of these ten CVEs gains a public exploit.

FAQ

Ten: four High, three Medium and three Low. According to the Node.js post's affected lines, all ten apply to 26.x, eight to 24.x and seven to 22.x.

Yes. The patched release for your line carries every fix that applies to it, and several exposures sit in code paths in libraries you may not have read. Upgrade first, then audit.

For official upstream builds, 22.23.4, 24.22.1 or 26.12.1, or a later release in the same line. Node.js's release notes show 26.13.0 matches 26.12.1 apart from LTS metadata, and 24.22.2 carries no security items.

I found no source saying so. CISA's KEV listing, as reported by BleepingComputer, covers only CVE-2026-111497.

The Node.js post lists only 26.x, 24.x and 22.x, and says end-of-life versions are always affected by security releases. Move to a supported line. If your Node.js comes from a distribution or other vendor, check that vendor's advisory, since it may backport fixes on its own schedule.

You've reached the end

Node.js October 2026 Security Release: All 10 Fixes

Back to the feedRead the full article

The full article has comments, related reading and sharing.