Node.js ships security releases for the 26.x, 24.x and 22.x lines
The October 21 updates fix ten issues, four rated high, including a Brotli decoder flaw and several TLS hostname verification problems.
The Node.js project published security releases on October 21, 2026 for the 26.x, 24.x and 22.x release lines: v26.12.1, v24.22.1 and v22.23.4. The highest severity among the fixed issues is rated high on all three lines.
Four issues are rated high. One is an out-of-bounds write in the bundled Brotli decoder that malformed input could trigger when an application decompresses data with node:zlib. Another is that dns.resolve functions truncate hostnames containing a NUL byte. Two more concern tls.checkServerIdentity accepting certificates for IP addresses written in unusual forms.
The remaining issues are rated medium or low. They cover HTTP keep-alive socket handling, certificates with numeric DNS names, repeated random values in snapshot-based startup, a ZIP header validation gap, and two Permission Model filesystem checks. Several of these are described as incomplete fixes for earlier reports.
Teams running Node.js should move to the patched version for their line, particularly services that decompress untrusted Brotli data or validate hostnames before resolving them. The project also reminds users that end-of-life versions are always affected by security releases and should be upgraded.
Sources
Verified Oct 23, 2026 (official source). nodejssecurityjavascript