SOLUTIONSQuick answer
On 21 October 2026 Node.js released 26.12.1, 24.22.1 and 22.23.4 to fix 10 vulnerabilities, four rated high. The most serious is an out-of-bounds write in the bundled Brotli decoder that can lead to remote code execution when an app decompresses untrusted data. Node.js 20 and older are end-of-life and get no fix, so upgrade now.
Key takeaways
- Safe versions: Node.js 26.12.1, 24.22.1 or 22.23.4 or later. Node.js 20 and older are end-of-life and stay vulnerable.
- CVE-2026-111497 (high): a Brotli decoder bug in
node:zlibcan cause a crash, memory disclosure or remote code execution. - Two high-severity TLS bugs let a certificate be checked against the wrong IP address for unusual IPv4 spellings.
- A DNS bug truncates hostnames at a NUL byte, so a validated name can resolve to a different one.
- The release also removes the compromised eMudhra intermediate certificates and updates OpenSSL, c-ares and Undici.
What did the October 2026 Node.js security release fix?
| CVE | Severity | Lines affected | What it does |
|---|---|---|---|
| CVE-2026-111497 | High | 26, 24, 22 | Brotli decoder writes past an 8-byte buffer on invalid input: crash, memory disclosure or RCE |
| CVE-2026-106069 | High | 26, 24, 22 | Leading-zero IPv4 (0127.0.0.1) is parsed differently by URL normalisation and the OS resolver, so TLS checks the wrong IP |
| CVE-2026-105483 | High | 26, 24 | Fullwidth-digit IPv4 hosts are treated as DNS names in tls.checkServerIdentity() |
| CVE-2026-105482 | High | 26, 24, 22 | dns.resolve*() and dns.reverse() truncate hostnames at a NUL byte |
| CVE-2026-105481 | Medium | 26, 24, 22 | Keep-alive sockets can accept a response sent before the request |
| CVE-2026-106072 | Medium | 26, 24, 22 | Non-canonical IPv4 (127.1, 0x7f.0.0.1) lets a DNS-only certificate name match an IP |
| CVE-2026-106074 | Medium | 26, 24, 22 | Snapshot and single-executable builds repeat randomUUID() and randomInt() values |
Three low-severity issues were also fixed: a zlib.ZipFile header bug and a Permission Model wildcard over-match (both 26.x only), and missing Permission Model checks in fs.realpathSync().
Is my Node.js app affected?
Every app on an unpatched supported line is affected by at least some of these bugs. The risk is highest for:
- Apps that decompress data from users or other servers with Brotli (
zlib.brotliDecompress,createBrotliDecompress, or frameworks and proxies that acceptContent-Encoding: br). - Services that make outbound HTTPS calls to IP addresses or user-supplied hosts, such as webhooks, link previews or scrapers, where the TLS and DNS bugs could be abused.
- Apps built as snapshots or single executables that use
crypto.randomUUID()for IDs or tokens. - Anything still on Node.js 20 or older. The Node.js project says end-of-life versions are always affected when a security release ships.
Next.js, Express, NestJS and most React server setups run on Node.js, so they need this runtime update in addition to any framework patches. If you use Next.js, check our Next.js October 2026 security update as well.
How do I upgrade Node.js safely?
- Check what you run with
node --versionon every server, container and CI image. - Pick the patched version on your line: 22.23.4, 24.22.1 or 26.12.1 (or later). If you are on 20.x or older, move to 22 or 24 and test before you deploy.
- Update Docker base images (for example
node:24-alpine) and rebuild; a pinned old tag will not update itself. - Update version managers and CI:
.nvmrc,enginesinpackage.json, and GitHub Actionssetup-nodeversions. - Restart the process. A running server keeps the old runtime until it restarts, for example with
pm2 restart <app>or a new container rollout.
Need help patching or upgrading?
Naarvix maintains Node.js and Next.js applications for businesses in India and worldwide, including runtime upgrades, dependency audits and zero-downtime releases. See our web development service or contact us for a security check.
Sources
Frequently asked questions
Which Node.js versions fix the October 2026 vulnerabilities?
Node.js 26.12.1, 24.22.1 and 22.23.4, released on 21 October 2026, and any later versions on those lines. Node.js 20 and older are end-of-life and receive no fix.
Is the Brotli bug exploitable if my app never uses zlib?
Your own code may not call zlib, but dependencies, HTTP clients or proxies can decompress Brotli data for you. The safe choice is to upgrade the runtime on every server and container.
Do I also need to update npm packages?
The fixes are in the Node.js runtime, so upgrading Node.js is the main step. Keep frameworks such as Next.js on their latest patched versions too, because they publish separate security fixes.