Node.js patches 10 vulnerabilities in v22, v24 and v26 updates
The October 21 releases fix a Brotli decoder out-of-bounds write rated High and refresh c-ares, OpenSSL, SQLite and undici.
Node.js released security updates v22.23.4, v24.22.1 and v26.12.1 on October 21 (UTC), fixing 10 vulnerabilities and updating several bundled dependencies. The v26 line carries all 10 fixes, while v24 receives 8 and v22 receives 7, according to forest.watch.impress.co.jp.
The highest-severity items are four High-rated flaws. Among them is CVE-2026-111497, an out-of-bounds write in the Node.js Brotli decoder that can allow remote code execution. Another, CVE-2026-105483, lets a TLS certificate hostname check be bypassed when an IP address is written in fullwidth digits; it affects the v26 and v24 lines only.
The remaining High issues include CVE-2026-105482, where dns.resolve truncates names containing a NUL character, CVE-2026-106069, a TLS hostname bypass when a host loosely resolves to an IP address, and CVE-2026-105481, a Medium-rated keep-alive socket problem in which a response written before the request was sent is processed.
Three Medium and three Low issues round out the batch. The Medium set includes improper certificate validation for non-canonical IPv4 hostnames (CVE-2026-106072) and crypto.randomUUID()/randomInt() entropy caches saved into user-land startup snapshots and SEAs, which repeat the same values (CVE-2026-106074).
Dependencies were bumped in the same release: c-ares 1.34.9, ca-cert, OpenSSL 3.5.9, SQLite 3.53.4 and undici 8.12.2/7.30.1/6.29.1. The ca-cert update addresses the compromise of an eMudhra intermediate certificate authority. The update was carried out as previously announced.
Quick answers
Which Node.js versions were updated?
v22.23.4, v24.22.1 and v26.12.1 were released on October 21 (UTC).
How many vulnerabilities were fixed?
10 in total: 10 in v26, 8 in v24 and 7 in v22, rated 4 High, 3 Medium and 3 Low.
Why was ca-cert updated?
The ca-cert update addresses the compromise of an eMudhra intermediate certificate authority.