Is Your Node.js App Exposed? October 2026 Security Releases Explained

The Node.js project has just released security updates for all three supported release lines: 26.x, 24.x and 22.x. The patches fix ten vulnerabilities, four of them rated High, including a flaw that can allow remote code execution. If your websites, APIs or back-end services run on Node.js, now is the time to check your version and update.

This guide explains what changed, who is affected, and how to patch your server safely.

Quick summary

• Release date: Wednesday, October 21, 2026
• Affected lines: Node.js 26.x, 24.x and 22.x
• Highest severity: High
• Total issues fixed: 10 (4 high, 3 medium, 3 low)
• Patched versions: v26.12.1, v24.22.1 and v22.23.4

Which version should you upgrade to?

• Node.js 26.x: upgrade to v26.12.1
• Node.js 24.x (LTS): upgrade to v24.22.1
• Node.js 22.x: upgrade to v22.23.4
• Node.js 20.x or older: move to a supported line, preferably 24.x LTS

The most serious fixes

Brotli decoder remote code execution (CVE-2026-111497). A flaw in the Brotli decoder can cause an out-of-bounds write that permits remote code execution. It affects 26.x, 24.x and 22.x. Applications that decompress Brotli content from outside sources are the most exposed, which includes many web servers, proxies and API clients.

Three flaws affecting DNS and TLS checks. These weaken how Node.js verifies who it is talking to:

• CVE-2026-105482: dns.resolve truncates names containing a NUL character (26.x, 24.x, 22.x).
• CVE-2026-105483: TLS certificate hostname bypass when an IP is written with fullwidth digits (26.x and 24.x).
• CVE-2026-106069: TLS certificate hostname bypass when a host loosely resolves to an IP address (26.x, 24.x, 22.x).

Certificate and hostname validation is what protects your server's outbound connections from impersonation. Bugs here matter most if your app calls third-party APIs, payment gateways, databases or microservices over TLS.

Medium and low severity fixes

The medium-severity issues include a keep-alive socket bug (CVE-2026-105481), improper certificate validation for non-canonical IPv4 hostnames (CVE-2026-106072), and a problem where crypto.randomUUID() and randomInt() can repeat the same values across processes started from snapshots or SEAs (CVE-2026-106074).

The low-severity issues cover a ZipFile validation bug (CVE-2026-106070) and two Permission Model problems (CVE-2026-106071 and CVE-2026-106073). Teams that use the Node.js Permission Model to sandbox their code should pay particular attention to the last two.

The release also refreshes bundled dependencies, including c-ares, Undici, OpenSSL and SQLite, plus an update to the CA certificate store related to the eMudhra Intermediate CA compromise.

Who needs to act?

Almost everyone running Node.js in production. The Node.js project states that End-of-Life versions are always affected by security releases and receive no patches. If you are on Node.js 20.x or older, upgrading to a supported line is the only way to get these fixes.

A quick self-check:

• Do you run any Node.js app, API or build tool on a live server?
• Does it make HTTPS requests to other services?
• Does it handle compressed content or user-supplied URLs and hostnames?

If you answered yes to any of these, update.

Check your current version

Connect to your server and run:

node -v

Compare the output with the patched versions in the table above. Anything lower on the same line, or on an unsupported line, needs an upgrade.

How to upgrade Node.js safely

1. Back up first

Create a full server backup or snapshot, and make a copy of your app's .env files and configuration.

2. Test on staging

If you are moving between major versions, run your test suite and key user flows on a staging copy before touching production. Review your dependencies for compatibility, and run npm audit.

3. Upgrade

Use the package or runtime management option in your Coreway dashboard if one is available for your server, and choose a patched version as the target.

If you manage Node.js yourself on the server, you can use nvm:

nvm install 22.23.4
nvm alias default 22.23.4
node -v

Replace 22.23.4 with 24.22.1 or 26.12.1 if you are on those lines.

4. Restart your app

A running process keeps using the old runtime until it restarts. Restart your application and any process manager, for example:

pm2 restart all

5. Verify

Confirm the new version with node -v, check your application logs, and test your critical pages and API endpoints.

Keep your Node.js servers secure long term

• Run a supported LTS version and plan upgrades ahead of end-of-life dates, using the official Node.js Release Schedule.
• Patch quickly. Subscribe to the nodejs-sec mailing list for security announcements.
• Audit dependencies regularly with npm audit and keep packages updated.
• Put a reverse proxy such as Nginx in front of your Node.js app, and expose only the ports you need.
• Automate backups so a rollback is always possible.

Final thoughts

The October 2026 Node.js releases are an important update, especially because of the Brotli remote code execution flaw and the TLS hostname validation issues. Check your version today, back up, upgrade to a patched release, and restart your app.

Read the full technical advisory on the official site: Node.js October 21, 2026 Security Releases.