Node.js October 2026 security releases: 10 vulnerabilities fixed

On 21 October 2026 the Node.js team shipped security releases for every supported line. They fix 10 vulnerabilities: 4 high, 3 medium and 3 low. The most serious one, in the Brotli decoder, can lead to code execution if your application decompresses data sent by someone else.

In short: move to Node.js 22.23.4, 24.22.1 or 26.12.1 (or later), then restart your applications.

The most important flaws

CVE-2026-111497: out-of-bounds write in Brotli (high)

Malformed compressed input can make the Brotli decoder write past a small internal buffer when it is decompressed with node:zlib. Depending on the case: a crash, a memory leak or code execution. Applications that decompress outside content are exposed: compressed HTTP responses, uploaded files, webhooks. The same flaw affects the Brotli library used elsewhere, including some PHP builds on Windows.

Three TLS hostname check bypasses (high and medium)

• CVE-2026-105483: an IP address written with Unicode "fullwidth" digits could pass the hostname check (24.x and 26.x);
• CVE-2026-106069: the same problem with unusually written addresses, for example octal with leading zeros;
• CVE-2026-106072 (medium): a non-standard IPv4 hostname could get a certificate issued for a domain name accepted.

In practice, an application that connects to addresses supplied by a user (API calls, webhooks, URL fetching) could accept the wrong certificate, which opens the door to traffic interception.

CVE-2026-105482: truncated DNS names (high)

dns.resolve*() and dns.reverse() cut a hostname at the first NUL byte. An allow-list based on the name could therefore be bypassed. This is an incomplete fix of an earlier flaw.

The others

• CVE-2026-105481 (medium): on a reused HTTP connection, a response sent before the request could be accepted;
• CVE-2026-106074 (medium): crypto.randomUUID() and crypto.randomInt() could return the same values across processes when the app starts from a startup snapshot or a single executable application (SEA);
• CVE-2026-106070, CVE-2026-106071, CVE-2026-106073 (low): ZIP reading and bypasses of the experimental permission model.

The same releases also update OpenSSL, c-ares, Undici, SQLite and the root certificates.

Fixed versions

Check your server

node --version

If you run several versions (nvm, Docker containers, a process manager), check each one:

ls ~/.nvm/versions/node 2>/dev/null
docker ps --format '{{.Image}}' | grep -i node

Update

• NodeSource or distribution package: sudo apt-get update && sudo apt-get install --only-upgrade nodejs
• nvm: nvm install 24 && nvm alias default 24
• Docker: rebuild your images from node:24 (or the fixed pinned version), then redeploy.

Then restart your applications (pm2 restart all, systemctl restart … or a redeploy): a running process keeps the old version in memory.

How FounderMode helps

The FounderMode agent inventories the software and dependencies on your servers, including npm packages, and checks them every day against public vulnerability databases. Your daily report tells you what to update first. Read more: Vulnerable dependencies and CVEs.

Frequently asked questions

Is my app vulnerable if it does not use Brotli?

The Brotli flaw needs the app to decompress outside data. But the TLS and DNS flaws affect any app that calls external services. Update in every case.

Do I need to update my npm dependencies?

Not for these flaws: they are in Node.js itself. You need to change your Node.js version and restart.

Do Node.js 18 or 20 get a fix?

No. End-of-life versions stay vulnerable with every security release. Move to Node.js 22 or 24.

Sources: Node.js security releases, 21 October 2026, CloudLinux advisory.