Node.js October 2026 security releases: what to upgrade and why

On 21 October 2026 the Node.js project shipped security releases for all three supported lines: v26.12.1, v24.22.1 and v22.23.4. They fix ten vulnerabilities. Four are rated high, and the one getting the most attention is an out-of-bounds write in the Brotli decoder that the project says permits remote code execution. The fix is already out for every supported line, so this is a routine upgrade, best done before it stops being routine.

Three kinds of fix in one release

The four high-severity issues are not one bug. They sit in three different parts of the runtime, and each one is reached by a different kind of code.

The Brotli decoder (CVE-2026-111497, all three lines). A memory bug in native code that decompresses data. My reading, as general reasoning rather than anything the advisory spells out: the code that reaches it is code that decompresses Brotli data someone else controls. A server that accepts compressed request bodies, or a client that fetches responses from third-party APIs and decompresses them, both qualify.

TLS hostname validation (CVE-2026-106069 on all three lines, CVE-2026-105483 on 26 and 24). These are logic bugs in the check that a certificate matches the host you meant to reach: one when the host loosely resolves to an IP address, one when an IP is written with fullwidth digits. A medium-rated sibling, CVE-2026-106072, lets DNS names in a certificate authenticate IP endpoints written in non-canonical IPv4 form. The exposed code is anything that connects to a host or IP that came from a user, a webhook setting or a config file.

DNS name handling (CVE-2026-105482, all three lines). dns.resolve truncates names that contain a NUL character. Again as general reasoning: that matters where a name you did not write yourself gets resolved, for example to check it against an allow list.

The rest are rated medium or low: a keep-alive socket that processes a response written before the request was sent, random values repeating in startup snapshots, and permission model and ZipFile issues. The release also updates bundled dependencies, including c-ares, Undici and the CA certificate list, which drops trust in the compromised eMudhra intermediate CA.

Check the Node you actually run

Your laptop is usually the least important place to check. The runtime that serves traffic comes from a Docker base image, and the one that runs your tests comes from a CI image. All of them can drift apart.

# on any machine, or inside a running container
node -v
# what a base image really ships, without trusting its tag name
docker run --rm node:22 node -v

Compare each answer against the fixed versions: 26.12.1 or later on 26, 24.22.1 or later on 24, 22.23.4 or later on 22. A tag like node:22 only moves when you pull it again, so a cached image on a build server can still be the old patch. If your Dockerfile pins an exact version, bump the pin.

Node 20 gets nothing

Node 20 "Iron" reached end of life; its last update was on 24 March 2026, and it is not in this release. The project states plainly that end-of-life versions are always affected when a security release occurs. So "we are on 20, it was not listed" means the opposite of safe. Odd-numbered lines like 25 and 23 are end of life too. The project's guidance is that production should only run Active LTS or Maintenance LTS lines, which today means 24 or 22, or 26 if you accept a Current release.

The next step is small: bump the base image pin in your Dockerfile and your CI config to the fixed patch for your line, rebuild without the cache, and let the test suite run. If you are still on Node 20, plan the move to 22 or 24 now rather than at the next advisory. Source: nodejs.org, Wednesday, October 21, 2026 Security Releases.