Node.js October 2026 Security Releases: Patch Before Lunch

Yesterday (Wednesday, October 21, 2026) the Node.js project shipped security releases for the 26.x, 24.x and 22.x lines. Ten CVEs, four rated high, plus a handful of dependency bumps. If you run Node anywhere that touches the internet (so… everywhere), this one is worth your coffee break.

The headline act is a Brotli decoder bug the advisory itself titles “out-of-bounds write permits remote code execution.” The supporting cast includes TLS hostname checks that can be confused by IP addresses written in weird ways, and a crypto.randomUUID() that, under the right conditions, gives every process the same “random” values. Comedy and tragedy in one changelog.

Primary source for everything below: the official advisory.

What Got Fixed (The Technical Bit)

The fixed versions are:

• Node.js v22.23.4
• Node.js v24.22.1
• Node.js v26.12.1

The four high-severity ones

1. Brotli decoder out-of-bounds write → potential RCE (CVE-2026-111497, high). Affects 26.x, 24.x and 22.x. The advisory’s own title says the out-of-bounds write “permits remote code execution.” In plain English: the code that unpacks Brotli-compressed data could write outside the memory it was given, which is the classic road to code execution. If your service decompresses Brotli data it didn’t produce itself, treat this one as the priority. Reported by mcollina, fixed by aduh95.

2. TLS hostname bypass with fullwidth digits (CVE-2026-105483, high). Affects 26.x and 24.x only. If an IP address is written using fullwidth digits (the wide Unicode versions of 0–9 you see in CJK text), the certificate hostname check could be bypassed. Reported by hasanfleyah, fixed by jasnell.

3. TLS hostname bypass when a host “loosely resolves” to an IP (CVE-2026-106069, high). Affects 26.x, 24.x and 22.x. A host string that loosely resolves to an IP address could slip past the certificate hostname check. Reported by anagnorisis2peripeteia, fixed by mcollina.

4. dns.resolve truncates names containing a NUL character (CVE-2026-105482, high). Affects 26.x, 24.x and 22.x. A name with a NUL byte in the middle gets cut short, so you can end up resolving a different name than the one you validated. Reported by hasanfleyah, fixed by jasnell.

The medium and low ones (don’t skip these)

• Keep-alive socket processes a response written before the request was sent (CVE-2026-105481, medium). 26.x, 24.x, 22.x. Reported by hasanfleyah, fixed by jasnell.
• Non-canonical IPv4 hostnames let DNS SANs authenticate IP endpoints (CVE-2026-106072, medium). Yet another certificate-validation edge case. 26.x, 24.x, 22.x. Reported by br41ny, fixed by mcollina.
• crypto.randomUUID() / randomInt() repeat across processes (CVE-2026-106074, medium). 26.x, 24.x, 22.x. More on this beauty below. Reported by gesposito, fixed by panva.
• ZipFile returns attacker-controlled prefix bytes after failed header validation (CVE-2026-106070, low). 26.x only. Reported by startimeash, fixed by mcollina.
• Permission Model filesystem over-grant via wildcard radix lookup (CVE-2026-106071, low). 26.x only. Reported by malikhamzaiqbal, fixed by jasnell.
• Permission Model bypass with fs.realpathSync (CVE-2026-106073, low). 26.x, 24.x, 22.x. Reported by 0xoroot, fixed by RafaelGSS.

Dependency updates

The release also bumps bundled dependencies for public vulnerabilities: c-ares, ca-cert (eMudhra Intermediate CA compromise) and Undici on all three lines, OpenSSL on 24.x and 22.x, and SQLite on 22.x.

What about exploitation?

The advisory doesn’t mention any exploitation in the wild. As of writing, I haven’t seen any reported. That’s not the same as “nobody is trying,” so don’t let it slow down your upgrade.

And Node 20?

No patch. Node.js 20 “Iron” is end-of-life (its last update was March 24, 2026, per the releases page), and the advisory is blunt: “End-of-Life versions are always affected when a security release occurs.” If you’re still on 20 or older, this is your sign.

The Funny Bit: Random, But Make It Deterministic

My favourite bug of the batch is CVE-2026-106074. The advisory title says it all: “crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values.”

Translation: Node keeps a little cache of random bytes to make these calls fast. If you build a startup snapshot or a single executable application (SEA), that cache got baked into the snapshot. So every process booting from it starts with the same pre-rolled dice.

You ship one binary to a hundred servers, and they all proudly generate the same “unique” ID. It’s the software equivalent of everyone at the party showing up in the same outfit and insisting it’s a coincidence. Great for reproducible builds, less great for session tokens.

Honourable mention to the fullwidth digits bug: an IP address that’s the same number, only wider. TLS looked at it, squinted, and let it in. Respect to whoever thought to try that.

Practical Takeaways (Upgrade Commands and Checks)

1. Check what you’re running:

node -v
# or, in your app / healthcheck:
node -p "process.version"

You want v22.23.4, v24.22.1, v26.12.1 or newer on your line.

2. Upgrade.

With nvm:

nvm install 24.22.1   # or 22.23.4 / 26.12.1
nvm alias default 24.22.1

With Docker, bump the base image and rebuild (don’t just restart):

FROM node:24.22.1-slim

Then check for anything still pinning an old version: .nvmrc, .node-version, engines in package.json, CI setup steps (actions/setup-node), and serverless runtime settings.

3. Rebuild snapshots and SEAs. If you use startup snapshots or single-executable apps, upgrading the runtime on your laptop isn’t enough. Rebuild the snapshot/binary with the patched Node so the random-cache fix actually ships.

4. Prioritise by exposure. Anything decompressing Brotli from outside, or making TLS connections to user-supplied hosts or IPs (webhooks, URL fetchers, proxies), goes first.

5. Get off EOL. Node 20 and older won’t get these fixes. Plan the jump to 22 or 24 LTS.

Final Thought

Ten CVEs sounds scary, but this is the system working: researchers reported, maintainers fixed, everyone got patches on the same day. Big thanks to the reporters and the Node.js security team for doing the unglamorous work.

Your job is the easy bit: run node -v, bump a version, rebuild, redeploy.

Until next time, may your UUIDs be unique and your digits normal-width. 😏

P.S. Full details and download links: Node.js October 21, 2026 security releases.