In this article
  1. What changed
  2. Why it matters
  3. What to do now
  4. Updates

TL;DR: The Node.js project released Node.js 22.23.4, 24.22.1 and 26.12.1 on October 21, 2026, fixing 10 vulnerabilities across its three supported release lines. The most serious, CVE-2026-111497, is an out-of-bounds write in Node’s Brotli decoder that Node.js says “permits remote code execution.” Four flaws are rated High, including three TLS and DNS issues, and the releases also pull in fixes for OpenSSL, c-ares, Undici and SQLite and distrust the compromised eMudhra certificates. If you run anything on Node.js, from an API server to a self-hosted n8n or a build pipeline, update the runtime and redeploy.

What changed

According to the Node.js security release post and the release notes:

  • Fixed versions: Node.js 22.23.4, 24.22.1 (LTS) and 26.12.1. All three release lines, 22.x, 24.x and 26.x, were affected. Node.js notes that “End-of-Life versions are always affected when a security release occurs.”
  • CVE-2026-111497 (High), Brotli decoder out-of-bounds write that “permits remote code execution”: affects 26.x, 24.x and 22.x. Node.js credits OpenAI Codex Security researchers with reporting it. The 24.22.1 release notes show the fix is a patch to Node’s bundled Brotli library.
  • CVE-2026-106069 (High): a TLS certificate hostname bypass “when the host loosely resolves to an IP address” (26.x, 24.x, 22.x).
  • CVE-2026-105483 (High): a TLS certificate hostname bypass when the IP address is written with fullwidth digits (26.x and 24.x).
  • CVE-2026-105482 (High): dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x).
  • Medium: a keep-alive socket can process a response written before the request was sent (CVE-2026-105481); certificate validation for non-canonical IPv4 hostnames lets DNS names in a certificate authenticate IP endpoints (CVE-2026-106072); and crypto.randomUUID() and randomInt() caches are saved into user-land startup snapshots and single executable apps, “so every process repeats the same values” (CVE-2026-106074).
  • Low: two Permission Model bypasses (CVE-2026-106071, CVE-2026-106073) and a ZipFile prefix-bytes issue (CVE-2026-106070, 26.x only).
  • Dependency fixes: c-ares, the CA certificate store (for the eMudhra intermediate CA compromise), Undici on all three lines, OpenSSL on 24.x and 22.x, and SQLite on 22.x.

The highest severity Node.js assigns to any issue in this release is High; none are rated Critical.

Why it matters

Node.js runs a large share of the web tools small teams depend on: Next.js and Astro sites, Express and Fastify APIs, Discord and Slack bots, self-hosted automation tools like n8n, and most JavaScript build pipelines. Brotli is a common compression format on the web, so a bug in the decoder is the kind of flaw that can be reached by data coming from outside. The TLS fixes matter if your app makes HTTPS calls to IP addresses or relies on Node to check certificates on outbound requests.

Updating npm packages doesn’t fix any of this. These bugs are in the Node.js runtime itself, so you have to update Node and restart or redeploy.

What to do now

  1. Check which Node.js you run. Run node -v on each server, and check the Node version or base image your hosting platform, Dockerfiles and CI use.
  2. Update to the fixed release for your line: 22.23.4, 24.22.1 or 26.12.1. If you use a version manager, install the new version and switch to it; on servers, install your distribution’s or NodeSource’s updated package once it’s out.
  3. Rebuild containers. If your Dockerfile uses a node:22, node:24 or node:26 tag, rebuild so the image pulls the new release, and pin the exact version if you can.
  4. Check your host. On serverless and managed platforms, the provider chooses the Node.js patch version. Check its changelog or status page, and redeploy if it says you need to.
  5. Move off old versions. Node.js 20 and older aren’t on the list of patched lines. If you’re still on one, plan a move to 22 or 24, since End-of-Life versions get no fixes.
  6. Restart everything that runs Node. Long-running processes keep using the old runtime until they restart.

These are the same Node.js versions our eMudhra certificate story lists as patched for the compromised certificates, so one update covers both.

Updates

  • Oct 22, 2026, 10:20 p.m. Manila: First published. We’ll add a dated note here if Node.js revises its advisory or publishes more detail on the Brotli flaw.

Sources & method

Sources

Method. Checked October 22, 2026, at 10:20 p.m. Manila time (14:20 UTC). The fixed versions, CVE IDs, severities, affected release lines and dependency updates come from the Node.js security release post; the Brotli patch detail comes from the 24.22.1 release notes. The steps under “What to do now” are our own judgment. No affiliate links on this page. How we work.

Spotted an error? See our corrections policy and tell us.