Node.js fixes 10 vulnerabilities in versions 26, 24, and 22, four of them rated high

The Node.js project released versions 26.12.1, 24.22.1, and 22.23.4 on October 21, 2026, and all three are security releases. Together they fix 10 vulnerabilities, four of which the project rates as high severity. If you run any supported Node.js line, the update applies to you, and versions past end of life get no fix at all.

The high-severity fixes

The most serious one is in the Brotli decoder, the compression format servers and browsers use to shrink web content. According to the project's advisory, an out-of-bounds write in the decoder permits remote code execution. It is tracked as CVE-2026-111497 and affects all three lines.

Two more high-severity issues let a connection get past the TLS hostname check, the step that confirms a certificate belongs to the address a program is connecting to. One works when an IP address is written with fullwidth digits and affects 26.x and 24.x. The other works when a host loosely resolves to an IP address and affects all three lines. A related medium-severity issue let a DNS name in a certificate authenticate an IP address written in a non-canonical form. The fix makes tls reject non-canonical IP addresses.

The fourth high-severity fix is in dns.resolve, which truncated names containing a NUL character. It now validates its input for null bytes.

Medium and low severity

Two medium-severity issues affect all three lines. In the first, a keep-alive socket could process a response that was written before the request was sent. In the second, the entropy caches behind crypto.randomUUID() and randomInt() were saved into user-land startup snapshots and single executable applications. Every process started from such a build then repeated the same values.

The three low-severity fixes concern less common features:

• ZipFile could return attacker-controlled bytes after a failed ZIP header check, in 26.x only.
• The Permission Model could grant broader filesystem access than intended through a wildcard lookup, in 26.x only.
• fs.realpathSync could bypass the Permission Model, in all three lines.

Certificates and dependencies

The advisory lists a root certificate update for the eMudhra intermediate CA compromise on all three lines. The release notes move the bundled root certificates to NSS 3.131.1 and make tls reject chains that contain blocked public keys. The public incident site now lists Node.js 22.23.4, 24.22.1, and 26.12.1 as fixed versions.

Every line also gets c-ares 1.34.9 and a newer Undici: 8.12.2 in 26.x, 7.30.1 in 24.x, and 6.29.1 in 22.x. The 24.x and 22.x lines move to OpenSSL 3.5.9, and 22.x updates SQLite to 3.53.4. The advisory does not say whether any of the vulnerabilities has been exploited.