The Node.js project published a Node.js security release on Wednesday, October 21, 2026, with patched builds for each supported branch: 26.12.1 on the newest branch, plus 24.22.1 and 22.23.4 on the two older ones. It closes ten CVEs, four of them rated high, including a flaw in the Brotli decompressor that the project says can permit remote code execution. If you run JavaScript on a server, this is the update to install this week.
Where it stands: By Thursday, October 22, the fixed versions were out, the advisory reports no exploitation, and none of the CVEs appears in CISA’s catalog of exploited bugs. This was a planned release, not a leak and not a hack.
The release landed on the same Wednesday as the PHP2Shell emergency patches, which is why many readers met it as one line in a longer list of bad news. TechCrunch described the Node.js announcement as a security surprise arriving alongside the PHP fixes, and it noted that the day’s incidents had no connection to one another. For the full picture of that day, see our October 21 cyberattacks timeline.
What did the October 2026 Node.js security release fix?
It fixed ten separately tracked flaws across the three supported branches and refreshed five bundled libraries. Each CVE number is a public tracking label for one specific bug, so ten numbers means ten distinct problems.
Node’s advisory rates each one high, medium or low. The project states that the highest severity issue fixed is HIGH on every line. If you see these bugs described elsewhere as “critical,” note that Node’s own top label for them is “high.”
| CVE | What Node.js says it is | Rating |
|---|---|---|
| CVE-2026-111497 | Brotli decoder out-of-bounds write that permits remote code execution | High |
| CVE-2026-105483 | TLS hostname bypass when an IP is written in fullwidth digits | High |
| CVE-2026-106069 | TLS hostname bypass when a host loosely resolves to an IP | High |
| CVE-2026-105482 | dns.resolve truncates names containing a NUL character | High |
| CVE-2026-105481 | Keep-alive socket handles a response written before the request | Medium |
| CVE-2026-106072 | Non-canonical IPv4 hostnames let DNS SANs authenticate IP endpoints | Medium |
| CVE-2026-106074 | Random-number caches saved into snapshots and SEAs repeat values | Medium |
| CVE-2026-106070 | ZipFile returns attacker-controlled prefix bytes | Low |
| CVE-2026-106071 | Permission Model filesystem over-grant | Low |
| CVE-2026-106073 | Permission Model bypass with fs.realpathSync | Low |
Not every bug touches every line. The ZipFile and wildcard over-grant issues affect only 26.x, for example, while the Brotli flaw affects all three.
Why is the Brotli bug the one to worry about?
Because it is the only flaw in the set that Node.js describes as permitting remote code execution, meaning an attacker could potentially run their own code on your server. Brotli is a compression format that servers and clients use to shrink web traffic, and Node ships a decoder for it.
An out-of-bounds write is a memory-safety bug: the program writes data past the edge of the buffer it was given. Node’s advisory does not publish technical detail beyond that description, and we are not adding any. The practical point is simple. Any Node service that decompresses Brotli data it did not create itself should be on a fixed build.
The advisory thanks a reporter with the handle mcollina for finding it and aduh95 for the fix. The commit list for 24.22.1 shows the change as a cherry-picked update to the bundled Brotli library.
What do the TLS and DNS fixes change?
They tighten how Node checks that a server is who it claims to be. TLS (Transport Layer Security) is the encryption behind HTTPS, and part of it is confirming that a certificate really belongs to the hostname you connected to.
Two high-rated bugs let that hostname check be bypassed when an IP address is written in unusual forms, and a medium-rated one involves non-canonical IPv4 hostnames. TechCrunch summarized the risk as a way around the checks that verify a server’s identity. The DNS bug, also rated high, involves names containing a NUL character being cut short.
Our companion piece on the TLS hostname fixes and the eMudhra certificate update covers this part of the release in more depth.
Which bundled libraries did Node update?
Five: c-ares, the CA certificate list, OpenSSL, SQLite and Undici, though not every line received all of them. These updates address vulnerabilities that were already public in those projects.
- c-ares (DNS) and Undici (HTTP client) on every supported branch. The 24.22.1 notes list c-ares 1.34.9 and Undici 7.30.1.
- CA certificates on all three lines, labelled in the advisory as a response to the eMudhra intermediate CA compromise.
- OpenSSL on 24.x and 22.x; the 24.22.1 notes show an upgrade to openssl-3.5.9.
- SQLite on 22.x only.
Was the Node.js release a leak, or found by AI?
Neither, based on every source we checked. Node.js pre-announced that new versions would arrive on or shortly after October 21, then published them. None of the reports we reviewed said Node.js bug details escaped early, and nothing suggests a breach of the project.
The advisory credits each finding to a named reporter and a named fixer, identified by GitHub handle. It does not mention AI tools. The week’s story about AI-assisted bug hunting concerns PHP2Shell, the separate PHP flaws patched the same day; our PHP2Shell patch guide covers those.
How do I upgrade Node.js safely?
Move to the fixed release for your line, then restart every process that runs Node. A patched binary on disk does nothing for a server still running the old one in memory.
- Find your version. Run
node -von each host and inside each container image. - Pick the target. On 26, install 26.12.1. On 24, install 24.22.1. On 22, install 22.23.4.
- Rebuild images. If you deploy containers, update the base image tag, rebuild and redeploy. Pinned old tags keep the old runtime.
- Check end-of-life lines. The project warns that “End-of-Life versions are always affected when a security release occurs.” If you are not on 22, 24 or 26, no fix is coming for your line.
- Restart and verify. Restart services and re-run
node -vthrough the same path your app uses.
Updating Node does not update your npm dependencies, and updating dependencies does not update Node. Both are separate jobs.
How many websites does this affect?
There is no count of vulnerable Node.js servers, and we would not invent one. W3Techs, on 22 October 2026, measured Node.js as a web server on 7.4% of websites whose web server it can identify. That counts only sites where Node is visible as the server. Node running behind a proxy, inside build tools or in internal services would not show up in that survey.
CISA’s Known Exploited Vulnerabilities (KEV) catalog lists bugs with evidence of real-world attacks. The edition CISA put out on October 21 (version 2026.10.21, stamped 14:04 UTC) lists none of the ten Node.js CVEs.
Frequently Asked Questions
Which Node.js versions fix the October 2026 vulnerabilities?
Upgrade the 26 line to 26.12.1, the 24 line to 24.22.1, or the 22 line to 22.23.4. All three shipped on October 21, 2026. Release lines past end of life get no patch, and the project treats them as affected by every security release.
Was Node.js hacked or leaked?
No. The Node.js project shipped a planned security release that it had announced in advance. No source reports a breach of Node.js or an early leak of the bug details.
Did AI find the Node.js bugs?
Nothing in the Node.js advisory says so. It thanks individual reporters by their GitHub handles and does not mention AI tools. The AI-discovery story that week belongs to the separate PHP2Shell flaws.
Are the Node.js flaws being exploited?
The Node.js advisory does not report exploitation, and none of the ten CVEs is in CISA catalog version 2026.10.21 of known exploited vulnerabilities. That can change, so updating promptly is still the safer course.
How do I check my Node.js version?
Run node -v in a terminal on the machine or inside the container. If the result is older than the fixed release for your line, update it and restart every process that runs Node.
Sources
- Wednesday, October 21, 2026 Security Releases — The Node.js Project (nodejs.org), October 21, 2026
- Node.js 24.22.1 (LTS) — The Node.js Project (Antoine du Hamel), October 21, 2026
- The internet is having a very bad cybersecurity day — TechCrunch (Sarah Perez), October 21, 2026
- CISA Catalog of Known Exploited Vulnerabilities — CISA (Known Exploited Vulnerabilities catalog, JSON feed), October 21, 2026
- Usage Statistics and Market Share of Node.js, October 2026 — W3Techs (Q-Success), 22 October 2026
This article is news reporting and general security information based on the public sources listed above, as they stood on the dates shown. Incident details often change as investigations continue; check the affected company’s own status page and notices for the latest. Data Breach Radar is not affiliated with any company named here.