Node.js Security Update: 10 Vulnerabilities Fixed in October 2026

The Node.js project released security updates on October 21, 2026, addressing 10 vulnerabilities across its 22.x, 24.x, and 26.x release lines.

The issues include a high-severity Brotli decoder vulnerability that can permit remote code execution, multiple TLS certificate validation flaws, and weaknesses affecting DNS resolution, HTTP handling, and the permission model.

For businesses running Node.js APIs, SaaS products, backend services, or web applications, this is a reminder that keeping application code updated is only one part of maintaining a secure production environment.

If your applications run Node.js, check your runtime version and prioritize the appropriate security update.

The October 21 release addresses several types of security weaknesses. Four vulnerabilities are rated High by the Node.js project, three Medium, and three Low.

Some of the most important issues include:

CVE-2026-111497 - High severity

A flaw in the Node.js Brotli decoder involves an out-of-bounds write, a memory-safety issue that can allow data to be written outside an intended memory boundary.

Under the relevant conditions, the vulnerability can permit remote code execution. Applications that decompress externally supplied Brotli-compressed data should prioritize the update.

The risk is not necessarily limited to code that directly calls a Brotli library. Compression and decompression may happen inside HTTP clients, request-processing middleware, or other dependencies.

CVE-2026-105483 and CVE-2026-106069 - High severity

These vulnerabilities affect how Node.js validates hostnames against TLS certificates in certain non-standard IP-address representation and hostname-resolution scenarios.

Certificate hostname verification is important because it helps ensure that an application is communicating with the intended server. Weaknesses in this process can undermine the protection expected from HTTPS connections.

Applications making outbound HTTPS requests should upgrade and verify that their TLS behavior remains correct after the update.

CVE-2026-105482 - High severity

This issue concerns how dns.resolve handles names containing a null character. Incorrect handling of such inputs can create unexpected behavior in applications that depend on DNS resolution.

The same security release also addresses weaknesses involving HTTP keep-alive processing, certificate validation, cryptographic random-value generation, ZIP-file handling, and Node.js's Permission Model.

Although these issues differ in severity and impact, they demonstrate why runtime security updates should be reviewed as a complete release rather than selecting fixes based only on the vulnerability title.

The Node.js project published the following fixed releases on October 21, 2026.

• Release line: Node.js 26.x and Fixed version: 26.12.1
• Release line: Node.js 24.x and Fixed version: 24.22.1
• Release line: Node.js 22.x and Fixed version: 22.23.4

These releases address the applicable security issues for their respective branches.

If your application runs Node.js 20.x, 25.x, or another end-of-life release line, do not assume that a security fix is available for that version. The project warns that end-of-life versions are affected when a security release occurs. Plan a move to a supported release line and test compatibility before deploying the upgrade.

For the complete vulnerability list and official release information, see the Node.js October 2026 security advisory.

Identify every production service running Node.js, including APIs, background workers, scheduled jobs, server-side rendering services, and containerized applications.

Do not rely on the version installed on a developer's laptop. Production environments may use a different runtime version.

Update the Node.js runtime to the appropriate fixed version for your release line. If your application uses Docker or another container platform, rebuild the image and redeploy it rather than assuming that updating the host will update the container.

Check your deployment pipeline and runtime configuration to ensure the intended version is actually being used.

Because this release includes a Brotli decoder flaw and TLS certificate-validation issues, pay particular attention to services that process compressed data or make outbound HTTPS requests.

Review relevant dependencies and middleware, but do not assume that avoiding an obvious direct function call eliminates the risk. The runtime or a dependency may perform the operation internally.

After updating, restart or redeploy affected services. Verify the runtime version in the actual production environment and check that the deployment is healthy.

Run appropriate regression tests for HTTP requests, DNS resolution, TLS connections, file processing, and other affected application paths.

The October Node.js security release also includes a certificate bundle update related to the eMudhra intermediate certificate authority compromise.

This is a separate trust issue from the Node.js runtime vulnerabilities, but it is another reason to review the complete release. Applications and environments that manage their own certificate bundles or trust stores should follow the relevant vendor guidance and verify that the necessary trust changes have been applied.

A runtime update is also an opportunity to check whether your application uses supported Node.js versions and maintained dependencies.

Keep a record of runtime versions, deployment environments, dependencies, and update responsibilities. This makes future security releases easier to assess and deploy.

Modern applications depend on more than the code written by their development teams. They also rely on runtime environments, libraries, network protocols, certificates, and deployment infrastructure.

A vulnerability in any of these layers can affect the security of the overall system. Regular patching, dependency management, automated testing, and deployment verification help reduce the chance that an avoidable weakness remains in production.

At Infynno, we build custom web applications, APIs, and business platforms using technologies including Node.js. We believe maintainable software requires attention not only to features and performance, but also to runtime support, dependency health, and ongoing security maintenance.

Not sure which Node.js version your application is running? Start by checking your production runtime and deployment configuration, then compare it with the official security release.

This article provides general security information. Refer to the official Node.js advisory and your hosting or operating system vendor for environment-specific remediation instructions.