Node.js Security Releases Fix Ten Runtime Vulnerabilities
Tech GuruQuick Answer
Node.js released 22.23.4, 24.22.1, and 26.12.1 for ten security issues, including High-severity DNS, TLS, and Brotli flaws. Inventory runtimes and derived images, update the supported line, restart processes, verify the running binary, and retain deployment evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Node.js runtimes, release lines, images, embedded copies, supervisors, services, and owners; deploy the supported fixed build; rebuild derived artifacts; restart every process; validate exposed workflows and controls; and retain evidence.
Last verified: 2026-10-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Node.js 22.x, 24.x, and 26.x release lines |
|---|---|
| Advisory | Node.js October 21, 2026 security release / Node.js 22.23.4 / Node.js 24.22.1 / Node.js 26.12.1 |
| CVEs | CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106070, CVE-2026-106071, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074, CVE-2026-111497 |
| Authoritative release date | 2026-10-21 10:39:12.420 UTC |
| Authority revision date | 2026-10-21 10:39:20.400 UTC |
| Affected versions | Node.js 22.x, 24.x, and 26.x before the October 21 security releases, with CVE-specific differences documented by Node.js; end-of-life releases are also affected when a security release occurs. |
| Fixed version | Node.js 22.23.4, 24.22.1, or 26.12.1, as applicable to the supported release line |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Node.js does not state that these vulnerabilities are being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Node.js released fixed builds for ten runtime vulnerabilities spanning DNS name handling, TLS hostname validation, Brotli decoding, HTTP keep-alive handling, randomness caches, ZIP parsing, and Permission Model checks. The highest authority-rated severity is High.
What To Validate Now
- Inventory. Identify Node.js runtimes, release lines, container and serverless images, embedded distributions, package managers, process supervisors, owners, and internet-facing services.
- Establish applicability. Match each runtime and CVE to the affected 22.x, 24.x, or 26.x lines. Do not infer safety for end-of-life Node.js branches; migrate them to a supported fixed line.
- Remediate. Install Node.js 22.23.4, 24.22.1, or 26.12.1 through the supported distribution channel, rebuild derived images and artifacts, and restart every runtime process.
- Validate. Confirm the running binary after restart, rebuild and rescan images, exercise DNS, TLS, compression, HTTP, startup snapshot, ZIP, and Permission Model workflows in scope, and retain deployment evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CVE applicability differs by release line, and end-of-life Node.js branches are affected but do not receive these fixes. A package or image update is not effective until the running process or workload has been restarted or replaced.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
