Node.js Issues Critical Security Updates
The open-source JavaScript runtime environment Node.js recently launched a vital security update. This release targets the 26.x, 24.x, and 22.x series. Developers successfully patched over ten security vulnerabilities. Consequently, these October 2026 security releases address four high-severity flaws.
High-Severity Vulnerabilities Resolved
First, developers fixed a critical DNS resolution issue (CVE-2026-105482). Specifically, dns.resolve truncated domain names containing NUL characters. This high-severity flaw impacted Node.js 26.x, 24.x, and 22.x. We thank hasanfleyah for the report and jasnell for the fix.
Second, the update addresses a TLS certificate bypass (CVE-2026-105483). Attackers could bypass hostname verification by representing IP addresses with full-width characters. This high-severity vulnerability affected versions 26.x and 24.x. We appreciate hasanfleyah for reporting this and jasnell for the resolution.
Third, another TLS verification bypass (CVE-2026-106069) received a patch. Loose parsing allowed malicious actors to resolve hostnames into IP addresses. This high-risk issue impacted versions 26.x, 24.x, and 22.x. Thanks go to anagnorisis2peripeteia for the discovery and mcollina for the patch.
Finally, a severe out-of-bounds write flaw existed in the Brotli decoder (CVE-2026-111497). This critical defect could trigger remote code execution. It affected Node.js 26.x, 24.x, and 22.x. We recognize mcollina for the report and aduh95 for the correction.
Medium-Severity Flaws Patched
Furthermore, the update mitigates several medium-severity vulnerabilities. Keep-alive sockets previously processed responses written before the request transmission (CVE-2026-105481). This affected all three current version branches. Thanks to hasanfleyah and jasnell for resolving this.
Additionally, incorrect certificate validation occurred with non-canonical IPv4 hostnames (CVE-2026-106072). This allowed DNS Subject Alternative Names to validate IP endpoints. This affected versions 26.x, 24.x, and 22.x. We thank br41ny and mcollina for their contributions.
Moreover, an entropy caching issue compromised cryptographic functions (CVE-2026-106074). The entropy cache for crypto.randomUUID() and randomInt() was saved into user-space startup snapshots. Consequently, processes repeatedly generated identical values. This flaw impacted all current branches. We appreciate gesposito and panva for addressing it.
Low-Severity Issues Addressed
Lastly, developers patched three low-severity flaws. The ZipFile utility returned attacker-controlled prefix bytes after header validation failures (CVE-2026-106070). This only affected Node.js 26.x. Thanks to startimeash and mcollina.
Similarly, the permission model granted excessive file system access (CVE-2026-106071). This occurred via a wildcard radix lookup mechanism in version 26.x. We thank malikhamzaiqbal and jasnell.
Also, attackers could bypass the permission model using fs.realpathSync (CVE-2026-106073). This issue affected versions 26.x, 24.x, and 22.x. We recognize 0xoroot and RafaelGSS for securing this flaw.
