If you run Node.js on servers or in applications, there is important news. The Node.js team has just released security updates for the three main release lines: 26.x, 24.x, and 22.x. The updates came out around 21 October 2026 and close several serious vulnerabilities.
What matters most: there are multiple high-severity issues. If your servers still run older versions, it is better to update soon so they do not become easy targets.
What was fixed
This is not a minor patch. Several CVEs stand out:
- CVE-2026-105482 (high) – dns.resolve truncates names that contain a NUL character. DNS resolution can become inaccurate.
- CVE-2026-105483 (high) – TLS certificate hostname can be bypassed when the IP is written with fullwidth digits. Affects 26.x and 24.x only.
- CVE-2026-106069 (high) – Another TLS hostname bypass, this time when the host loosely resolves to an IP address.
- CVE-2026-111497 (high) – The Brotli decoder can write out of bounds, opening a path to remote code execution. This is the most concerning one.
There are also medium and low issues: keep-alive sockets processing a response before the request was sent, improper certificate validation for non-canonical IPv4 hostnames, entropy caches from crypto.randomUUID() and randomInt() leaking into startup snapshots, and a few Permission Model problems.
Dependency updates included
Besides core Node.js fixes, the release also updates key dependencies: c-ares, ca-cert (related to the eMudhra Intermediate CA compromise), OpenSSL (on 24.x and 22.x), SQLite (on 22.x), and Undici. So the security improvement covers both the runtime and the components underneath.
Available versions
These versions already contain all the fixes:
- Node.js v22.23.4
- Node.js v24.22.1
- Node.js v26.12.1
The highest severity fixed across all three lines is HIGH. End-of-Life versions remain affected, so make sure you stay on a supported release according to the official Node.js schedule.
Why this matters for operations
Many modern apps, APIs, and backend services run on Node.js. When the runtime has an RCE path or certificate bypass, the impact can reach the data and services themselves. Routine updates like this are usually easier than handling an incident later.
If you need stable infrastructure for your business, colocation and connectivity services at Platinum can be a practical choice so you can focus on the core business instead of server and patching chores.
The takeaway is simple: check the Node.js version you are running now. If it is below the ones listed above, plan the update soon. A little effort now is better than dealing with publicly known vulnerabilities later.
