Node.js released security updates on October 21 for its 22.x, 24.x, and 26.x branches, addressing ten vulnerabilities across decompression, certificate verification, DNS handling, and other runtime features. The patched versions are 22.23.4, 24.22.1, and 26.12.1. Four issues carry high-severity ratings, including an out-of-bounds write in the Brotli decoder that the project says permits remote code execution. For deployment teams, this is a runtime update, not simply another application-dependency refresh.
The official Node.js security advisory now explicitly says the updates are available and lists the patched downloads. Its lower sections retain advance-notice language about the planned release date; that older wording should not be mistaken for the current availability status. The announcement is also the basis for the severity counts: four high, three medium, and three low. Not every listed flaw affects every branch, so the total describes the release set rather than ten identical exposures in every installation.
The Brotli issue, CVE-2026-111497, affects all three release lines. An out-of-bounds write means a decoder can write outside the memory area intended for its operation. That crosses a different boundary from an ordinary JavaScript exception: the project’s stated consequence is code execution, not merely a failed decompression request. However, the advisory does not document the precise triggering input, exploitation prerequisites, or reliability of an attack. It does not establish that every internet-facing Node.js application is remotely exploitable. Mapping where untrusted compressed data reaches the runtime is therefore useful triage, not a substitute for installing the fix.
Three high-severity findings concern names and identity. CVE-2026-105482 makes dns.resolve truncate names containing a NUL character and affects all three branches. CVE-2026-105483 bypasses TLS certificate hostname checks when an IP address is written using fullwidth digits; its listed scope is 26.x and 24.x. CVE-2026-106069 concerns a hostname-check bypass when the host loosely resolves to an IP address and affects all three. The common engineering concern is inconsistent interpretation: a destination string must not acquire a more permissive identity merely because different layers interpret its representation differently.
A related medium-severity issue, CVE-2026-106072, allows DNS subject alternative names in certificates to authenticate IP endpoints when IPv4 hostnames are non-canonical. That distinction matters because establishing an encrypted connection and authenticating the intended destination are separate tasks. Engineers testing the update should include outbound HTTPS behavior and unusual destination representations in their regression plans. These are testing priorities inferred from the advisory’s affected features, not a claim that the project has published a complete exploit matrix.
The release also reaches application packaging. CVE-2026-106074 saves the entropy caches used by crypto.randomUUID() and crypto.randomInt() into user-land startup snapshots and single executable applications, causing processes to repeat values. It affects all three branches. The failure is more specific than saying Node.js randomness is universally broken: the advisory identifies cached state captured in reusable startup artifacts. Teams using those artifacts should include rebuilding them with the patched runtime in remediation planning, rather than checking only the version installed on a developer workstation.
The remaining findings extend beyond those headline risks. A medium-severity keep-alive socket issue can process a response written before its request was sent. Two low-severity findings affect 26.x: attacker-controlled prefix bytes returned after failed ZIP-header validation and excessive filesystem permission grants through wildcard radix lookup. Another low-severity Permission Model bypass involving fs.realpathSync affects all three branches. These differences argue for testing the features an application actually uses while avoiding the assumption that a low rating makes a control-boundary flaw irrelevant.
Dependency changes accompany the runtime fixes. The advisory lists c-ares, CA-certificate data, and Undici updates across all three branches, OpenSSL updates for 24.x and 22.x, and a SQLite update for 22.x. The CA-certificate entry references the eMudhra intermediate-CA compromise without supplying a detailed incident account. Those component-specific scopes should remain distinct from the Node.js CVE counts; the announcement does not justify treating every dependency update as another separately enumerated runtime vulnerability.
A practical rollout starts by identifying the runtime embedded in deployed services and build artifacts, selecting the patched release for the appropriate maintained branch, and validating the replacement before broad deployment. Rebuilt containers and restarted services need to run the new binary; changing a manifest alone is not evidence that running workloads changed. Prioritize regression checks around decompression, DNS and TLS, snapshot-based packaging, and permission-restricted filesystem access. The project also warns about end-of-life versions: these releases are not evidence that unsupported branches have become safe. The central operational question is which deployed artifacts still contain the old runtime, not whether the application’s package list changed.
