Node.js published security updates on October 21 for release lines 26, 24, and 22, correcting ten vulnerabilities, four of them high severity. The fixed versions are 26.12.1, 24.22.1, and 22.23.4.
The most severe issue lies in the Brotli decoder, tracked as CVE-2026-111497. It is an out-of-bounds memory write that can lead to remote code execution and affects all three release lines. The advisory does not detail the exploitation conditions required.
Two high-severity flaws impact TLS name verification. CVE-2026-105483 bypasses the check when an address uses full-width digits, while CVE-2026-106069 fails with names that resolve imprecisely to an IP address. In practice, a certificate may be accepted for a destination that is not the intended one.
The fourth high-severity issue resides in DNS. CVE-2026-105482 causes the dns.resolve function to truncate names containing a null character, opening the door to inconsistency between the queried name and the name actually resolved.
Among the medium-severity issues are out-of-order processing in HTTP socket keep-alive, incorrect certificate validation for non-standard IPv4 addresses, and repetition of cryptographic random values in snapshot initialization and single-executable applications, affecting crypto.randomUUID and crypto.randomInt.
The three low-severity issues involve attacker-controlled bytes returned after ZIP header validation failure, excessive file access via wildcard in the Permission Model, and bypass of that model via fs.realpathSync.
The package also updated c-ares, CA certificates, Undici, OpenSSL, and SQLite. The recommended remediation is to install the appropriate version for the release line in use, rebuild application images where present, and restart services. The project advises testing outbound HTTPS connections, DNS handling, Brotli-compressed content, and permission-restricted workloads. Unsupported release lines received no fixes, so users on those lines must migrate.
