Node.js October 2026 security releases: what to update

On 21 October 2026 the Node.js project shipped security releases for every supported line: Node.js 26.12.1 (Current), 24.22.1 (LTS) and 22.23.4 (LTS).

The high severity fixes

• CVE-2026-111497: an out of bounds write in the Brotli decoder that permits remote code execution.
• CVE-2026-106069 and CVE-2026-105483: ways around the TLS certificate hostname check when a host loosely resolves to an IP address, or when an IP is written in fullwidth digits.
• CVE-2026-105482: dns.resolve truncates names that contain a NUL character.

Also in this release

• crypto.randomUUID() could repeat the same values in every process of a single executable application (CVE-2026-106074, medium).
• Permission Model fixes for filesystem grants and fs.realpathSync (low).
• Dependency updates for c-ares, Undici, the CA certificates (the eMudhra intermediate CA compromise), OpenSSL on 24.x and 22.x and SQLite on 22.x.

What to do

1. Update to 26.12.1, 24.22.1 or 22.23.4, whichever line you run.
2. Rebuild container images and restart long running processes so the new binary is the one serving traffic.
3. On a hosting panel, pick the new version in the Node.js app settings and restart the app.

What it means for ATLAS sites

Sites built on @atlas/nuxt run on Node.js 22 or newer, so they should move to one of the patched versions. Details are in the Node.js announcement.