Node.js fixes ten vulnerabilities in versions 22, 24 and 26

On 21 October 2026 the Node.js project released security updates for its three supported lines: 22.23.4, 24.22.1 and 26.12.1. Together they fix ten vulnerabilities, four of them rated High.

The most serious ones

• An out-of-bounds write in the Brotli decoder that can allow remote code execution (CVE-2026-111497).
• Two ways around the check that a TLS certificate matches the server's name: an IP address written in full-width digits (CVE-2026-105483), and a host name that loosely resolves to an IP address (CVE-2026-106069).
• dns.resolve cutting a name short at a NUL character (CVE-2026-105482).

The releases also update bundled components, among them c-ares, undici and OpenSSL, and the root certificate store, in response to a compromised eMudhra intermediate certificate authority.

Who should update

Anyone who runs Node.js: servers, APIs, server-rendered websites and build machines. Node.js 20 and 25 have reached their end of life and get no fix, so anything still on them should move to 22, 24 or 26.

Where we stand

Our apps' servers are written in Python and our websites are static files, so none of our products runs a Node.js server. We use Node.js only as a build tool on our own machines, and we updated it to 22.23.4 and 24.22.1 the same day.

Source: Node.js security releases, 21 October 2026.