Node.js released security updates on October 21, 2026 covering three supported lines. Details below follow the project’s release as summarised by independent testers; check the official advisory before acting.
Fixed versions
v26.12.1, v24.22.1 and v22.23.4. Ten CVEs were fixed, four rated HIGH.
The four HIGH issues
- CVE-2026-105482 (dns.resolve*): names containing a NUL character are truncated, so a different name than the one validated is queried. Affects 26.x, 24.x, 22.x.
- CVE-2026-105483 (TLS hostname verification): a certificate check can be bypassed using an IP address written in fullwidth digits. Affects 26.x and 24.x.
- CVE-2026-106069 (TLS hostname verification): a host that becomes an IP address only after normalisation can pass the check against the wrong address. Affects 26.x, 24.x, 22.x.
- CVE-2026-111497 (Brotli decoder in zlib): an out-of-bounds write, described as possible remote code execution. Affects 26.x, 24.x, 22.x. It can also be reached through
fetch(), which decompresses responses sent withContent-Encoding: br.
What to do
- Run
node -von servers, build agents and container images. - Upgrade to the fixed version for your line, and rebuild images that pin Node.
- End-of-life lines (v25, v23, v20) get no fix. Move to v26, v24 or v22. One tester found v25.3.0 still accepted some bad inputs, so do not treat it as partly patched.
- Check bundled Node in tools such as desktop apps and CI runners, which update on their own schedule.
Where to be skeptical
- Security feeds label the Brotli bug “unauthenticated remote code execution” (some score it CVSS 9.2). The project describes it as possible RCE, and the independent test did not demonstrate the out-of-bounds write. Exploitability will depend on context.
- We have not seen reports of exploitation in the wild.
- Severity ratings differ between sources; use your own exposure (does your code decompress untrusted Brotli or call
fetch()on untrusted hosts) to prioritise.
Takeaway
This is a routine but important patch cycle. The main risk is the long tail of unpatched or end-of-life runtimes in forgotten services and containers.
