Node.js 26.12.1, 24.22.1 and 22.23.4 security releases (21 Oct 2026) fix ten CVEs, four rated High including a Brotli decoder out-of-bounds write that can allow remote code execution (CVE-2026-111497) and TLS hostname-check bypasses, and remove the compromised eMudhra intermediates
The Node.js project said in an advance notice dated 14 October 2026 that it will ship new versions of the 26.x, 24.x and 22.x release lines on or shortly after Wednesday 21 October 2026 to fix security vulnerabilities. The highest severity issue in each of the three lines is rated High. Node.js has not yet published the CVE numbers, affected components or fixed version numbers; those come with the release. The project reminds users that end-of-life versions are always affected when a security release happens, which includes Node.js 20 (last release 20.20.2 in March 2026) and older lines that will get no fix. Latest releases before the security update were 26.12.0 and 24.22.0 (both 14 October) and 22.23.3 (23 September). Node.js runs a large share of web back ends, build pipelines, serverless functions and developer tooling, including in Australian organisations. Separately, a trust-store change for the compromised eMudhra intermediate certificates was still listed as pending for Node.js on 21 October (see this desk's eMudhra card); the advance notice does not say whether this release includes it. Primary: Node.js security release notice (14 Oct). UPDATE (21 Oct): Node.js published the security releases: 26.12.1, 24.22.1 and 22.23.4. They fix ten vulnerabilities. High: CVE-2026-111497, an out-of-bounds write in the Brotli decoder that Node.js says permits remote code execution (26.x, 24.x, 22.x); CVE-2026-105482, dns.resolve truncating names that contain a NUL character (all three lines); CVE-2026-105483, a TLS certificate hostname check bypass when an IP address is written in fullwidth digits (26.x, 24.x); and CVE-2026-106069, a TLS hostname check bypass when the host loosely resolves to an IP address (all three). Medium: CVE-2026-105481 (a keep-alive socket can process a response written before the request was sent), CVE-2026-106072 (DNS SANs can authenticate non-canonical IPv4 endpoints) and CVE-2026-106074 (crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable applications, so every process repeats the same values). Low: CVE-2026-106070 (ZipFile returns attacker-controlled prefix bytes, 26.x), CVE-2026-106071 (Permission Model wildcard over-grant, 26.x) and CVE-2026-106073 (Permission Model bypass with fs.realpathSync). The releases also update c-ares and Undici on all three lines, OpenSSL on 24.x and 22.x and SQLite on 22.x, and update Node's bundled CA certificates for the eMudhra intermediate CA compromise on all three lines. Node.js publishes severity ratings, not CVSS scores. Primary: Node.js security release post (updated 21 Oct).
- Product
- Node.js JavaScript runtime (26.x Current, 24.x and 22.x LTS)
- Versions
- Fixed: 26.12.1, 24.22.1 and 22.23.4. Affected: earlier 26.x, 24.x and 22.x releases (CVE-2026-105483, -106070 and -106071 do not affect every line); end-of-life lines including 20.x are affected and will not be fixed.
- CVSS
- not published; Node.js rates four issues High (CVE-2026-111497, -105482, -105483, -106069), three Medium and three Low
- Exploited in Australia?
- unknown
- Patch to
- Update Node.js to 26.12.1, 24.22.1 or 22.23.4 now, including Docker base images, serverless runtimes, CI runners and bundled copies inside Electron or other apps; rebuild single executable applications and startup snapshots so they stop repeating random values. Move anything still on Node.js 20 or older to a supported line, as end-of-life versions get no fixes.
Primary: Node.js — Wednesday, October 21, 2026 Security Releases (advance notice 14 Oct; release details 21 Oct 2026) · Vendor: Node.js — release lines and end-of-life schedule · CVE: CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073