What was released

On 21 October 2026 the Node.js project announced security releases for every supported line:

  • Node.js 26.x: update to v26.12.1.
  • Node.js 24.x: update to v24.22.1.
  • Node.js 22.x: update to v22.23.4.

Together they fix ten vulnerabilities, four of them rated high. The full list, with credits and details, is in the official Node.js announcement.

The four high-severity issues

  • CVE-2026-111497: Brotli decoder out-of-bounds write that can permit remote code execution (affects 26.x, 24.x, 22.x).
  • CVE-2026-105483: TLS certificate hostname check bypass when an IP address is written with fullwidth digits (affects 26.x, 24.x).
  • CVE-2026-106069: TLS certificate hostname check bypass when a host loosely resolves to an IP address (affects 26.x, 24.x, 22.x).
  • CVE-2026-105482: dns.resolve truncates names that contain a NUL character (affects 26.x, 24.x, 22.x).

The Brotli flaw is the one to read twice: an out-of-bounds write in a decoder that handles data from outside your service is exactly the kind of bug that leads to remote code execution. The two TLS issues weaken the hostname check that tells your service it is talking to the server it meant to reach.

Medium and low issues

  • CVE-2026-105481 (medium): keep-alive sockets can process a response written before the request was sent (affects 26.x, 24.x, 22.x).
  • CVE-2026-106072 (medium): non-canonical IPv4 hostnames let DNS SAN entries authenticate IP endpoints (affects 26.x, 24.x, 22.x).
  • CVE-2026-106074 (medium): crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable applications, so processes can repeat the same values (affects 26.x, 24.x, 22.x).
  • CVE-2026-106070 (low): ZipFile returns attacker-controlled prefix bytes after ZIP header validation fails (affects 26.x).
  • CVE-2026-106071 (low): Permission Model grants more filesystem access than intended through a wildcard lookup (affects 26.x).
  • CVE-2026-106073 (low): Permission Model bypass with fs.realpathSync (affects 26.x, 24.x, 22.x).

Updated dependencies

The releases also update bundled dependencies:

  • c-ares and Undici on 26.x, 24.x and 22.x;
  • CA certificates on 26.x, 24.x and 22.x, following the eMudhra intermediate CA compromise;
  • OpenSSL on 24.x and 22.x;
  • SQLite on 22.x.

End-of-life versions

The announcement is explicit: versions that are past their end of life are affected whenever a security release happens, and they get no fix. If you still run one, the update is a move to a supported line, so plan it now rather than after the next release. The Node.js release schedule shows which lines are supported.

How to update

First, find every Node.js you run: servers, containers, CI images, serverless functions and developer tooling. Then update each one to the fixed version of its line.

node -v                      # what is running now
nvm install 22.23.4          # or 24.22.1 / 26.12.1, with nvm
docker build --pull -t my-app .   # rebuild on the new base image

Docker. Images such as node:22 or node:22-alpine are rebuilt by their maintainers when a release ships. --pull makes your build fetch the new base instead of reusing a cached one; redeploy every environment, not only production.

Packages. If you install Node.js from your distribution or a package repository, update through it and check which version it provides for your line.

LineXa Studio. Node.js backends are built from the official node:<version>-alpine image. Deploy them again so the image is rebuilt, then check the version your service reports.

After updating, restart the processes and run node -v again. A long-running process keeps the old runtime until it restarts.

In short

Ten fixes, four rated high, one of them a possible remote code execution: update to v26.12.1, v24.22.1 or v22.23.4, rebuild and redeploy every image, and move off any end-of-life line. If you would like a hand reviewing how your platform keeps runtimes patched, book a Cloud Security Review and Runtime Patching Audit and we will check it with you.