Node.js shipped security releases on 21 October for its 26.x, 24.x and 22.x lines: v26.12.1, v24.22.1 and v22.23.4. Four issues are rated high, and the headline is the Brotli decoder. The announcement’s own sentence is not elegant but it is clear: “A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.” It affects all three lines.
That one matters to any service that accepts compressed request bodies from people you do not control, which is a lot of Node web apps behind a proxy. An out-of-bounds write in the decoder sits in front of your application code, so the patch is the runtime, not the app.
The two hostname bypasses
CVE-2026-105483 is “TLS certificate hostname bypass when the IP is written fullwidth digits”, affecting 26.x and 24.x. CVE-2026-106069 is the same class of problem when “the host loosely resolves to an IP address”, and it affects all three lines. Both are the ones to care about if you run Node code that makes outbound TLS connections and relies on its hostname verification, especially when you connect to endpoints by IP or by a name that resolves to one: a bypass means the certificate check can be satisfied by a certificate that should not have matched. The titles are as much detail as the announcement gives, so there is no exploit narrative to add.
The DNS item
CVE-2026-105482, “dns.resolve truncates names containing NUL char”, affects all three lines. That belongs on the list for anything resolving names it does not control through Node’s DNS API. The title is the extent of what the announcement says about it.
The release notes also carry Medium-rated items beyond the four highs. The announcement lists them by title only, and this piece does not stretch them further.
What the same releases refresh
Each release also updates bundled dependencies “to address public vulnerabilities”: c-ares on all three lines, ca-cert on all three, OpenSSL on 24.x and 22.x, SQLite on 22.x and Undici on all three.
The ca-cert line is specific: “ca-cert (eMudhra Intermediate CA Compromise)”. If you read this week’s eMudhra story, that is the same removal distributions shipped as ca-certificates updates, arriving in Node’s own bundled trust store. For a Node service that does its own TLS with the runtime’s store rather than the system one, this release is how that fix reaches it.
Updating
Check what you are running with node -v, then move to 26.12.1, 24.22.1 or 22.23.4 through whatever channel you already use for the runtime. Container images should be rebuilt once the official node images carry the release rather than patched in place. Applications that bundle their own Node build, desktop apps in the Electron family among them, follow their vendor’s schedule rather than this announcement.
One boundary worth keeping: “high” is Node’s rating. The announcement publishes no CVSS scores and no exploit detail, so treat this as a runtime patch to apply now, not a story about attacks in progress.