Node.js ships security releases for 22.x, 24.x and 26.x, with four high-severity fixes
The October 21 update covers DNS, TLS hostname checks and the bundled Brotli decoder, plus dependency updates for c-ares, OpenSSL, SQLite and Undici.
The Node.js project published security releases on October 21 for the 26.x, 24.x and 22.x lines, as v26.12.1, v24.22.1 and v22.23.4. The highest severity issue fixed is rated high on all three lines.
Four of the ten issues are rated high. One lets dns.resolve and dns.reverse truncate a hostname at a NUL byte, so an application that checks a name against an allowlist could resolve a different name. Two are TLS hostname verification problems involving unusual IPv4 spellings, such as fullwidth digits or a leading zero. The fourth is an out-of-bounds write in the bundled Brotli decoder, reachable when an application decompresses untrusted input with node:zlib.
The remaining issues are rated medium or low. They include a keep-alive socket reuse flaw in the HTTP agent, entropy caches for crypto.randomUUID and randomInt being saved into startup snapshots, and two Permission Model problems. Which lines are affected differs per issue, and the release also updates several bundled dependencies.
Teams running Node.js in production should move to the patched version for their line and rebuild any container images or single executable applications built from older versions. Applications that decompress user-supplied Brotli data or validate hostnames before resolving them deserve the earliest attention. End-of-life versions receive no fixes, per the project notice.
Sources
Verified Oct 25, 2026 (official source). nodejssecurityjavascript