- Last verified
- 31 Oct 2026
- CVE
- CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069
- Status
- Fixed in 22.23.4, 24.22.1 and 26.12.1. Node.js 20 is end of life.
What happened
On 21 October 2026 the Node.js project released security updates for the 22.x, 24.x and 26.x lines. They fix 10 CVEs: four High, three Medium and three Low. Node.js 20 is end of life and does not get these fixes.
| Line | Fixed in |
|---|---|
| 22.x | 22.23.4 |
| 24.x | 24.22.1 |
| 26.x | 26.12.1 |
The four High issues
| CVE | What it is |
|---|---|
| CVE-2026-111497 | Out-of-bounds write in the bundled Brotli decoder on malformed input. It can crash the process, disclose memory or lead to remote code execution. |
| CVE-2026-105482 | dns.resolve*() and dns.reverse() cut a hostname at a NUL byte. A name that passes your allowlist can resolve to another name’s records. |
| CVE-2026-105483 | tls.checkServerIdentity() does not treat IPs written with fullwidth digits as IPs. A certificate with a DNS name can be accepted for them. |
| CVE-2026-106069 | An IPv4 host with leading zeros is read as octal during the certificate check but as decimal by the OS resolver. A certificate can be validated for a different IP. |
The Medium and Low issues include more certificate checks for unusual IPv4 notations, repeated values from crypto.randomUUID() in startup snapshots and two flaws in the permission model. The release also updates c-ares, undici and the root certificate store. OpenSSL is updated on 22.x and 24.x, and SQLite on 22.x.
The Brotli flaw matters most if your service decodes Brotli data from outside, for example request bodies, proxied responses or uploaded files. The TLS and DNS issues matter if you validate certificates for IP addresses or build allowlists on hostnames.
Find every Node you run
The common failure is not the main app. It is the forgotten service that is still on an old image or a Node 20 runtime.
# A host or a container
node -v
# An image you pull or build
docker run --rm your-image:tag node -v
# AWS Lambda functions on a Node runtime
aws lambda list-functions --query "Functions[?starts_with(Runtime,'nodejs')].[FunctionName,Runtime]" --output text
# Scan images for known issues
trivy image --severity HIGH,CRITICAL your-image:tag
Also check CI. actions/setup-node and GitLab runner images pin a Node version of their own, and build tools such as npm scripts run on it.
What to update first
- Services that decode untrusted Brotli data or validate IP certificates. Move them to 22.23.4, 24.22.1 or 26.12.1 or newer.
- Anything on Node 20. It will not get a fix. Plan the move to 22 or 24 now.
- Container base images. Rebuild without cache so the new Node and the updated root certificates are pulled in. A
node:22tag only helps if you actually rebuild and redeploy. - Lambda and other managed runtimes. Check which Node version the runtime ships and when the provider patches it. If you cannot wait, use a container image or a layer with a fixed Node.
A note on trust stores
The release also carries an updated root certificate store after the eMudhra intermediate CA compromise. Google Cloud lists the same event in bulletin GCP-2026-071. If you manage your own OS images or containers, update the trust stores there too.
How we can help
We build the inventory that makes this a one hour job next time: every runtime, every image and every pipeline, with the version it runs and who owns it. If you want that across AWS, Azure and Google Cloud, book a call from the button below.