Node.js 26.12.1, 24.22.1, 22.23.4 fix 10 security flaws

The Node.js project shipped security releases for all three supported release lines on October 21, 2026, fixing 10 vulnerabilities. Four are rated high, including a bug in the Brotli decoder that the project says can allow remote code execution. Anyone running Node.js 26, 24 or 22 should move to 26.12.1, 24.22.1 or 22.23.4.

The fixed versions and what they cover

Node.js is the JavaScript runtime behind most server-side JavaScript, from web APIs to build tools. The Node.js security post lists the fixes by severity: four high, three medium and three low. Each release line has one patched version.

Release line	Patched version	Status
26.x	26.12.1	Current
24.x	24.22.1	LTS
22.x	22.23.4	LTS

LTS means long-term support: a line that keeps getting fixes for years. According to the Japanese site Jinrai, which checked how vendors responded, 24.x is supported until April 30, 2028 and 22.x until April 30, 2027. Node.js 26 is planned to become LTS on October 28, 2026.

The same releases update five bundled libraries: c-ares (DNS lookups), Undici (the HTTP client behind fetch), OpenSSL, SQLite and the built-in certificate list. That last change blocks certificates from eMudhra, the certificate authority whose keys were exposed this week. Tech AI Wire covered that incident in eMudhra CA keys compromised: Go, Firefox, NSS ship fixes.

The four high-severity bugs

CVE	What goes wrong	Lines affected
CVE-2026-111497	Brotli decoder writes out of bounds, allowing remote code execution	26, 24, 22
CVE-2026-106069	TLS hostname check passes when a host loosely resolves to an IP address	26, 24, 22
CVE-2026-105483	TLS hostname check passes when an IP is written in fullwidth digits	26, 24
CVE-2026-105482	dns.resolve cuts short names that contain a NUL character	26, 24, 22

Brotli is a compression format that web servers and browsers use to shrink responses. An out-of-bounds write means the decoder puts data past the end of the memory it was given. Jinrai notes that the official post does not yet describe the conditions an attacker would need.

The two TLS bugs sit in the check that a server's certificate matches the address you asked for. If an address is written in an unusual form, the check can approve the wrong certificate. Jinrai cites the fix record as saying exploitation is "not easy." No attacks had been reported as of early October 22 Japan time.

The medium and low bugs worth a look

One medium bug affects apps built as single executable applications (SEAs) or from startup snapshots. Both bake a prepared copy of the program into one file. According to the Node.js post, the random-number caches behind crypto.randomUUID() and randomInt() were saved into that copy, so every process repeated the same values.

Another medium bug lets a keep-alive connection accept a response written before the request was sent. Two low-rated bugs hit the Permission Model, the opt-in sandbox that limits which files a script can touch.

What this means for developers

The upgrade is routine, but where Node.js comes from decides how fast it lands.

• Check every runtime, not just your laptop. Run node --version in production, CI and containers. Jinrai found the official Docker images already tagged with the fixed versions, while Homebrew still offered 26.12.0 hours later.
• Rebuild single-file apps. If you ship an SEA or use a startup snapshot, rebuild it with a patched Node.js. A fixed runtime does not repair random values already baked into an old binary.
• Leave Node.js 20 and 25. The Node.js post says end-of-life lines are always affected, and Jinrai confirms neither gets a fix. Version 20 left support on April 30, 2026.
• Prioritize services that decompress client data. A public API that accepts Brotli-compressed request bodies is the clearest target for CVE-2026-111497.

The eMudhra block arrives with the upgrade, as heise online points out. Node.js now carries a list of blocked intermediate certificates, so it can reject a chain even when its root is still trusted. The last Node.js security fix, in September, was smaller: Node.js 22.23.3 LTS fixes an HTTP/2 use-after-free bug.