Node.js October 2026 Security Release Patches 10 Flaws

On October 21, 2026, the Node.js Project released security updates across its supported release lines—versions 22.23.4, 24.22.1, and 26.12.1—to address 10 vulnerabilities, including four rated high severity. The most critical flaw, tracked as CVE-2026-111497, is an out-of-bounds write vulnerability in the bundled Brotli decoder that allows remote code execution (RCE) when processing specially crafted compressed streams.

The update also resolves high-severity TLS certificate hostname verification bypasses involving non-standard or full-width IP address formats (CVE-2026-105483 and CVE-2026-106069), fixes a NUL-character truncation issue in dns.resolve (CVE-2026-105482), and revokes trust in compromised eMudhra intermediate CA certificates. Organizations running Node.js are strongly advised to upgrade their runtimes and rebuild container images and single-executable applications immediately.