Node.js security patch (October 2026)
On 21 October 2026 Node.js shipped a security release with 10 CVEs for the 26.x, 24.x and 22.x lines. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decompressor that allows remote code execution. The fixed versions are v26.12.1, v24.22.1 and v22.23.4; 20.x and 25.x are end of life and get no patch.
Do you have this vulnerability? We update Node.js on your servers, Docker images and pipelines, check that the application still responds the same way, and plan the line change if you are still on 20.x or 25.x.
$ node -vv22.20.0# 22.x is fixed in v22.23.4: affected$ docker run --rm api:prod node -vv20.19.5# The production image runs 20.x: no patch$ cat .nvmrc22# The repo pins the line, not the patchv26.12.1 · v24.22.1 · v22.23.4Ten CVEs in one release, four rated high
The release fixes four high, three medium and three low severity vulnerabilities. As of 21 October, no exploitation of any of them had been reported.
CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor that allows remote code execution. You do not need to call zlib yourself to be exposed: according to Cyberkendra, Express 5 and fetch() decompress Brotli automatically.
The other three high-severity issues affect networking. CVE-2026-106069 and CVE-2026-105483 bypass the hostname check on TLS certificates, the check that makes sure your application is talking to the server it thinks it is when it makes an HTTPS request. CVE-2026-105482 makes dns.resolve truncate names that contain a NUL character.
The same release rejects certificate chains that use the compromised eMudhra keys, from the Indian certificate authority whose eight intermediate certificates were generated with weak keys. The end-of-life 20.x and 25.x lines get none of this.
Fixed Node.js versions
If a service runs a version older than the one listed for its line, it is affected. There is no fixed version for 20.x and 25.x: the way out is changing lines.
| Line | Fixed in | Note |
|---|---|---|
| 26.x | v26.12.1 | |
| 24.x | v24.22.1 | |
| 22.x | v22.23.4 | |
| 25.x | No patch | End of life: move to 26.x |
| 20.x | No patch | End of life: move to 22.x or 24.x |
Check this
- You run APIs, backends or server-side rendering (Next.js, Nuxt, Astro, NestJS, Express) on Node.js.
-
node -von the server, or inside the Docker image, reports a version older than your line’s fix. - Your Dockerfile uses a tag like
node:22and the image has not been rebuilt: it still has whatever version was current at build time. - Some service is still on 20.x or 25.x: those lines will not be patched.
- Your application decompresses Brotli (through
fetch(), Express 5 or its own proxy) or makes HTTPS requests to third parties.
If you are still on 20.x or 25.x
Node.js has not published temporary mitigations for this release. On an unsupported line, the only fix is to leave it.
- 01 End-of-life lines do not get this fix or any future ones.
- 02 Moving from 20.x to 22.x or 24.x usually means reviewing dependencies with native modules and testing the full build.
- 03 While the migration runs, it helps to know which endpoints accept compressed bodies and which services download outside content: those move first.
Seven steps, in this order
We follow the same procedure on every server: first find out which version runs where, then fix it, and finally check that nobody got in before the patch.
Version inventory
We find where Node.js runs: servers, Docker images, serverless functions, CI runners and the .nvmrc or engines field of each repository. Each one can carry a different version.
Immediate mitigation
With no official mitigation, we start with the most exposed services: the ones that accept Brotli bodies or download third-party content go first in the queue.
Update
We move to v26.12.1, v24.22.1 or v22.23.4, rebuild the images and pin the version in the Dockerfile, .nvmrc and CI. If you are on 20.x or 25.x, we plan the line change.
Verification
We check the version inside the container running in production, run the tests and confirm that HTTPS calls to third parties still validate certificates.
Review for indicators of compromise
We go through application and system logs looking for process crashes, unexplained restarts and processes or files that should not be there.
Secret rotation, if needed
If there are signs of access, we rotate sensitive environment variables: API keys, database credentials and tokens.
Monitoring new advisories
We record each service’s version and the end-of-life date of its line, so the next security release starts from that inventory.
Where Node.js stays unpatched
Running services on Node 20 and not sure what moving them takes?
Free consultation →Node.js security release FAQ
Which Node.js versions fix CVE-2026-111497?
I use Node 20. Am I affected?
Does it affect me if I do not use Brotli?
Is changing the Docker base image enough?
Tell us where your Node.js runs
We start with the inventory: which version each service runs, which one moves first and which line needs a migration.
Tell us your challenge. We'll propose a solution.
No commitment. Within 24 hours, you'll receive a proposal with scope, timeline and budget. No fine print.