Node.js released security updates on Oct. 21 Taipei time for its maintained 26.x, 24.x and 22.x branches, upgrading them to 26.12.1, 24.22.1 and 22.23.4. According to the project’s security advisory, the release fixes 10 vulnerabilities in total: four rated high, three medium and three low. The highest severity across all supported branches was listed as HIGH.
The project also warned that end-of-life, or EOL, versions are commonly affected when security releases are issued, and said users should move to supported versions as soon as possible.
High-severity flaws hit Brotli, DNS and TLS hostname checks
Among the four high-severity issues, CVE-2026-111497 affects the Brotli decoder. Node.js described it as an out-of-bounds write that could lead to remote code execution, and said it impacts the 26.x, 24.x and 22.x lines.
The other high-severity flaws are CVE-2026-105482, where DNS resolution can be truncated when a name contains a null byte, affecting all three supported branches; CVE-2026-105483, a TLS certificate hostname verification bypass when an IP address is written with full-width digits, affecting 26.x and 24.x; and CVE-2026-106069, another TLS hostname verification bypass when a host maps to an IP after permissive parsing, affecting all three branches.
The advisory noted that not every high-severity issue applies to every maintained branch, so operators need to match their deployed versions against the published impact ranges before rolling out updates.
Medium- and low-severity issues cover keep-alive, random cache behavior and the permission model
The medium-severity set includes CVE-2026-105481, where keep-alive connections may process a response before a request is sent; CVE-2026-106072, which involves improper certificate validation for non-standard IPv4 hostnames; and CVE-2026-106074, where the random cache used by crypto.randomUUID() and randomInt() can be written into user startup snapshots and single executable applications, or SEA, causing different processes to repeat the same values. All three affect 26.x, 24.x and 22.x.
The low-severity issues are CVE-2026-106070, where a ZIP header validation failure can return attacker-controlled prefix bytes, affecting only 26.x; CVE-2026-106071, an overly broad filesystem wildcard grant in the permission model, also limited to 26.x; and CVE-2026-106073, which allows the permission model to be bypassed through fs.realpathSync, affecting all three branches.
Dependency updates include c-ares, OpenSSL, Undici and SQLite
Beyond the core codebase, Node.js also updated several dependencies in response to disclosed issues. The advisory said c-ares, the root certificate bundle, including handling related to the eMudhra intermediate CA, and Undici apply across all three branches. OpenSSL updates appear in 24.x and 22.x, while SQLite updates appear in 22.x.
Branch release notes also list component version changes, including c-ares to 1.34.9, OpenSSL to 3.5.9, and Undici to 8.12.2 for 26.x, 7.30.1 for 24.x and 6.29.1 for 22.x.
PHP issued security fixes on the same day
PHP also published security updates the same day, setting 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as the fixed versions for two critical issues that can lead to unauthenticated remote code execution: CVE-2026-109618 and CVE-2026-109619.
For teams running both Node.js and PHP services, Oct. 21 amounted to a day of simultaneous pressure on the execution layer and language runtimes. The source article said the practical order is to deploy the official fixed versions first, then review reverse proxies, compression negotiation and certificate chain settings, rather than focusing only on the technical narrative of a single CVE.
Upgrade path centers on supported branches
The source article said Node.js remains a common foundation for cloud services, cryptocurrency trading interfaces and AI agent toolchains. This release set the top severity at HIGH and specifically pointed to the Brotli path as well as TLS and DNS validation surfaces, showing that connection handling and content decoding remain active attack surfaces.
For developers, the shortest path is to upgrade by branch to 26.12.1, 24.22.1 or 22.23.4, then verify that container images, CI images and local toolchains are no longer pinned to older versions. For systems still running on EOL lines, Node.js said they should be moved to supported versions as soon as possible.