Node.js ships security releases for 26.x, 24.x and 22.x, fixing four high-severity issues
The October 21 releases cover a Brotli decoder memory flaw, DNS name truncation and TLS hostname checks, among ten CVEs.
The Node.js project published security updates for the 26.x, 24.x and 22.x release lines on October 21, 2026. The new versions are v26.12.1, v24.22.1 and v22.23.4, and the project rates the highest severity among the fixes as high.
Four of the ten fixed issues are rated high. One is an out-of-bounds write in the bundled Brotli decoder, which malformed compressed input could use to corrupt memory in applications that decompress data with node:zlib. Another is that dns.resolve*() and dns.reverse() could silently cut off a hostname at an embedded NUL byte. Two more concern TLS hostname verification for IP endpoints written in unusual ways, such as fullwidth digits or a leading-zero octet.
The remaining fixes are rated medium or low. They include keep-alive socket handling, repeated values from crypto.randomUUID() and randomInt() when a startup snapshot is built, a zlib.ZipFile validation gap, and two Permission Model issues involving wildcard grants and fs.realpathSync().
Teams running any of the three lines should move to the patched versions. Applications that decompress untrusted Brotli data, or that check hostnames before resolving them, are the most directly affected. The project notes that end-of-life versions are always affected by a security release.
Sources
Verified Oct 26, 2026 (official source). nodejssecurityjavascript