Node.js ships security updates fixing ten flaws, four rated high severity
in plain words
Node.js is a tool that developers use to run websites and apps. Its makers have released updates that fix ten security holes. The most serious one could let an attacker run harmful code on a computer.
Full summary
Node.js has released security updates for its 26.x, 24.x and 22.x branches to close ten vulnerabilities. The release details name 26.12.1, 24.22.1 and 22.23.4 as the patched versions, and the releases were scheduled for October 21, 2026. Four of the flaws are rated high severity, the top rating across all three branches.
The most serious potential outcome is remote code execution through the Brotli decoder, tracked as CVE-2026-111497. The advisory describes an out-of-bounds write, meaning the decoder can write outside its intended memory area. Applications that process untrusted Brotli-compressed content should receive particular attention during patch planning. The notice does not explain the exact conditions needed for exploitation.
Two high-severity issues involve TLS Transport Layer Security The standard that encrypts connections between a browser or app and a server. Full definition of TLS certificate hostname checks. CVE-2026-105483 allows a hostname verification bypass when an IP Internet Protocol The internet's basic rules for sending data, using numeric addresses for every connected device. Full definition of IP uses full-width digits, affecting the 26.x and 24.x branches. CVE-2026-106069 involves hostnames that loosely resolve to an IP address and affects all three branches. Both concern whether a certificate correctly matches the intended destination.
The fourth high-severity issue, CVE-2026-105482, causes dns.resolve to truncate names containing a NUL character. The flaw affects all three release lines and raises concerns for applications that depend on consistent name handling before DNS Domain Name System The internet's directory that links domain names to computer addresses. Full definition of DNS lookups. The fixes follow earlier Node.js TLS authentication bypass patches.
Three medium-severity issues were also fixed. CVE-2026-105481 lets a keep-alive socket process a response written before its request was sent. CVE-2026-106072 concerns improper certificate validation for nonstandard IPv4 hostnames. CVE-2026-106074 affects cached random data in startup snapshots and single executable applications, which can repeat values returned by crypto.randomUUID() and crypto.randomInt().
The remaining issues carry low ratings. CVE-2026-106070 concerns attacker-controlled bytes returned after failed ZIP header checks, and CVE-2026-106071 can grant excessive filesystem access through wildcard matching; both affect 26.x. CVE-2026-106073 bypasses Permission Model checks through fs.realpathSync across all three branches.
The project advises administrators to deploy the matching patched release, rebuild application images where needed and restart affected services. It warns that end-of-life branches remain affected even after security releases, so migrating to a supported branch is part of remediation.