Node.js Patched High Severity Flaws on Oct 21. Update Now Before Nov 11

On October 21, 2026, the Node.js project shipped security releases for the supported lines. The fixed builds are 26.12.1, 24.22.1 and 22.23.4. The highest severity issues in that batch are rated High.

One of them is a Brotli decoder bug that can lead to remote code execution. Others let a crafted hostname bypass DNS or TLS checks. If your site or API runs on Node, this is the kind of update you do the same day.

There is a second clock running too. Node.js has already pre-announced another High severity security release for 26.x, 24.x and 22.x on or shortly after Wednesday, November 11, 2026. Details and CVE numbers are not public yet. Get onto the October builds now. Watch for November 11 and update again when those builds land.

What Was Fixed on October 21?

Here are the High severity issues from the official advisory.

Brotli decoder out-of-bounds write (CVE-2026-111497, High).
The Brotli decoder bundled with Node can write past the end of an internal buffer when it gets malformed compressed input. An attacker who can feed Brotli data into node:zlib may crash the process, leak memory or run their own code. This hits 26.x, 24.x and 22.x.

DNS names truncated at a NUL byte (CVE-2026-105482, High).
dns.resolve*() and dns.reverse() can silently truncate a hostname that contains a NUL character. An app that validates a name and then resolves it can end up talking to a different host than the one it checked. This hits 26.x, 24.x and 22.x.

TLS hostname bypass with fullwidth digits (CVE-2026-105483, High).
A certificate can be accepted for an IPv4 address when the host is written with non-ASCII digits such as fullwidth characters. The check treats it like a name instead of an IP. This hits 26.x and 24.x.

TLS hostname bypass with a leading-zero IP (CVE-2026-106069, High).
A non-canonical IPv4 literal such as 0127.0.0.1 can normalize to one address in Node and resolve to another on the OS. The certificate can then be checked against the wrong IP. This hits 26.x, 24.x and 22.x.

There are medium and low issues too. One is a keep-alive HTTP Agent bug (CVE-2026-105481, Medium) where a reused socket can accept a response that arrived before the new request was sent. Others cover odd IPv4 spellings in TLS checks, random UUID caches inside startup snapshots, ZipFile header handling and the Permission Model. The same release also updates c-ares, ca-cert, OpenSSL (24.x and 22.x), SQLite (22.x) and Undici.

Who Is Affected?

You are in scope if any of these is true.

• Your production app, API or build server runs Node.js 22.x, 24.x or 26.x below the fixed builds.
• You host a React or Next.js site whose server or serverless runtime is Node.
• You run background jobs, bots or custom tooling on Node next to a WordPress site.
• You are still on an end-of-life line such as 20.x or 25.x. Those lines get no security builds. The only fix is to move to a supported line.

Supported lines right now are 22.x, 24.x and 26.x (Active LTS as of 26.13.0 on October 28). Later builds that already include the October fixes are fine. What matters is that you are at or above 26.12.1, 24.22.1 or 22.23.4 on your line.

Why This Matters for Your Business

Node sits under a lot of modern sites. A React storefront, a booking API and a form backend often share the same runtime. A High severity flaw there can mean stolen customer data, spam injected into pages that Google then flags, or downtime while you rebuild a compromised server. A second emergency follows when the November 11 details go public and scanners start looking for unpatched hosts.

Waiting for a quiet weekend is how small businesses get caught. The October fixes are already out. The November release is on the calendar. Two short update windows beat one long incident.

How to Fix It. Step by Step

1. Back up first.
Snapshot the server or container and export any databases your Node app uses. Keep a copy off the machine.

2. Check the version you actually run in production.
On the server run node -v. Check your hosting panel, Docker image tag, CI image and any serverless runtime setting too. Staging and production often drift.

3. Update to a fixed build.
Move to at least 26.12.1, 24.22.1 or 22.23.4 on your current line. Prefer the newest patch on that line if your host already offers one. Redeploy and confirm node -v shows the new number.

4. If you are on Node 20 or 25, plan a line upgrade.
Those lines are end of life. There will be no October fix and no November fix for them. Pick 22, 24 or 26, test on staging and cut over.

5. Restart every process that loads Node.
PM2, systemd, containers, serverless cold starts and CI runners all need the new binary. An old worker left running still serves the old code.

6. Smoke-test the app.
Hit login, checkout, forms, file uploads and any path that decompresses data or talks to other hosts over TLS. Watch error logs for a short window after the deploy.

7. Put November 11 on your calendar.
Subscribe to the nodejs-sec list or watch the November 2026 security releases page on nodejs.org. When the builds appear, repeat steps 1 through 6. Do not invent CVE numbers ahead of time. Wait for the official advisory.

8. Review who can deploy and which images you trust.
Pin Node versions in Dockerfiles and lockfiles. Drop unused deploy keys. Give production access only to people who need it.

I Can Help Keep Your Stack Current

Security releases move fast. Most small business owners should not have to track Node advisories next to plugin updates and DNS changes.

I build, host and secure WordPress and React sites for small businesses. I can also take over hosting and security for a site you already have, whether an agency, an in-house team or an AI tool built it. With my managed hosting and security maintenance you get

• runtime and dependency updates applied and verified, including Node when your stack uses it
• WordPress core, plugin and theme updates on the same watch list
• automatic off-site backups and a tested restore path
• 24/7 uptime and security monitoring with firewall and malware scanning
• help with SEO and Google Ads when a security issue has hurt traffic or rankings

You run the business. I keep the site current and online.

Not sure which Node version your site runs? Contact me for a free stack check and we will map a safe update path before November 11.