Convika
Sign up free

Node.js October 2026 security release: what to update

Convika Team19 min read

  • security
  • nodejs
  • technical
On this page

As of October 23, 2026, 00:45 JST (October 22, 15:45 UTC). Every fact that can change carries the time it was checked, in JST (UTC+9). This page covers the Node.js security release of October 21, 2026 only.

Updated October 23, 2026, 00:45 JST: CVE-2026-111497 now has a CVSS 4.0 score of 9.2 (Critical), from Google as its CVE Numbering Authority. Homebrew's node, node@24, and node@22 now ship the fixed versions, Bun 1.4.4 ships the Brotli fix, and Debian's tracker lists the CVE with no fixed package yet.

Node.js 22.23.4, 24.22.1, and 26.12.1, released on October 21, 2026, fix 10 vulnerabilities. The worst, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that the Node.js advisory says permits remote code execution. Install a fixed version and restart your processes. Node 20 and Node 25 get no fix.

Your app can reach the bug without ever calling Brotli itself: Node's built-in fetch() decompresses Content-Encoding: br responses, and Express 5's body parser decompresses br request bodies by default. As checked on October 23, 00:41–00:43 JST, CVE-2026-111497 has a CVSS 4.0 score of 9.2 (Critical), assigned by Google as the CVE Numbering Authority; the other nine CVEs have no published record or score. CISA's Known Exploited Vulnerabilities catalog doesn't list any of the 10, and the Node.js advisory says nothing about attacks in the wild.

Below: the fixed versions, the 10 CVEs as the advisory ranks them, why the Brotli bug reaches past Node, a table to check whether your code is reachable, what each hosting platform and install channel has said or shipped, and the update steps.

Which Node.js versions are fixed

Release lineStatus on October 22, 2026Fixed versionWhat to do
26.xCurrent; becomes LTS on October 28, 202626.12.1Update
24.x "Krypton"Maintenance LTS since October 20, 2026; end of life April 30, 202824.22.1Update
22.x "Jod"Maintenance LTS; end of life April 30, 202722.23.4Update
25.xEnd of life since June 1, 2026NoneMove to 26, 24, or 22
20.x "Iron"End of life since April 30, 2026NoneMove to 22 or 24

The statuses and dates are from the Node.js release schedule (checked October 22, 11:54 JST). The three releases were published on GitHub on October 21 at 10:38 UTC (19:38 JST), and each release note calls itself "a security release". The advisory adds one line for the two lines without a fix: "End-of-Life versions are always affected when a security release occurs."

The 10 CVEs, as the advisory ranks them

The titles below are the Node.js advisory's, word for word, and so are the severity labels, which the advisory writes in lowercase (checked October 22, 11:54 JST).

CVEAdvisory titleSeverity (Node.js)Lines affected
CVE-2026-111497Node.js Brotli decoder out-of-bounds write permits remote code executionHigh26.x, 24.x, 22.x
CVE-2026-106069TLS certificate hostname bypass when the host loosely resolves to an IP addressHigh26.x, 24.x, 22.x
CVE-2026-105482dns.resolve truncates names containing NUL charHigh26.x, 24.x, 22.x
CVE-2026-105483TLS certificate hostname bypass when the IP is written fullwidth digitsHigh26.x, 24.x
CVE-2026-105481Keep-alive socket process a response that was written before the request was sentMedium26.x, 24.x, 22.x
CVE-2026-106072Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpointsMedium26.x, 24.x, 22.x
CVE-2026-106074crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same valuesMedium26.x, 24.x, 22.x
CVE-2026-106070Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validationLow26.x
CVE-2026-106071Permission Model filesystem over-grant via wildcard radix lookupLow26.x
CVE-2026-106073Permission Model bypass with fs.realpathSyncLow26.x, 24.x, 22.x

The order is this page's: the Brotli bug first, because it is the only one the advisory says permits remote code execution and it is reachable through default code paths. The advisory itself lists the High issues in a different order and gives no attack details.

CVE-2026-111497 now has a CVSS score: 9.2, Critical. Google, as the CVE Numbering Authority (CNA) for this ID, published its record at CVE.org on October 22 at 22:35 JST (13:35 UTC), titled "Out-of-Bounds Write in Google Brotli Decoder", with the CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The NVD added the record at 23:17 JST with Google's score and none of its own (checked October 23, 00:41 JST). The Node.js advisory still labels the bug High.

AT:P in that vector means, in the CVSS 4.0 specification's words, "The successful attack depends on the presence of specific deployment and execution conditions of the vulnerable system that enable the attack." Google's record doesn't say which condition it has in mind. It names what the attacker sends: "a crafted Brotli-compressed stream". The reach table below shows whether one can get to your decoder.

The other nine IDs are still RESERVED at CVE.org with no published record, and the NVD has no entry for them (checked October 23, 00:41–00:42 JST). CVE.org doesn't show which CNA owns them, so who will publish their scores is not known.

Two notes on the labels. Vercel's bulletin says that researchers "demonstrated process-memory disclosure and command execution in the Node.js process on unpatched 22.x, 24.x and 26.x"; the Node.js advisory doesn't say this itself. And the fix commit for CVE-2026-105483 calls its bug "a low-severity bug that's not easy to exploit", while the advisory labels it High.

The Brotli bug is in Google's library, not only in Node

Node.js bundles the Brotli decoder from Google's open-source brotli library. Node's fix for CVE-2026-111497 is a cherry-pick of brotli commit 0ed4268a, "Detect and report invalid stream earlier.", which is dated February 27, 2026. On October 21 between 19:26 and 19:27 UTC (October 22, 04:26–04:27 JST), google/brotli published v1.2.1, v1.1.1, and v1.0.10, each listing "CVE-2026-111497: out-of-bounds write permits remote code execution" under SECURITY. Google's CVE record, published on October 22 at 22:35 JST, tells users to update "any Brotli libraries or binaries" to "1.0.10 or 1.1.1 or 1.2.1". The brotli repository has published no GitHub security advisory (checked October 23, 00:40 JST).

So the fix reaches you through whatever supplies your decoder, and that isn't always Node's own build:

  • Debian and distributions built like it. Debian builds its nodejs package with --shared-brotli (its debian/rules, checked 12:00 JST), so a Debian Node uses the system Brotli library. There, the Brotli fix has to come as a Brotli library update, and the TLS and DNS fixes as a nodejs update.
  • Homebrew. Homebrew builds its node, node@24, and node@22 formulas with --shared-brotli against its own brotli formula (checked 12:29 JST). That formula moved to 1.2.1 on October 22 at 06:34 JST, and its bottles (prebuilt packages) followed at 10:29 JST. The node formulas with the TLS and DNS fixes followed, each with bottles: node@22 22.23.4 at 13:54 JST, node 26.12.1 at 15:01 JST, and node@24 24.22.1 at 15:39 JST on October 22 (checked October 23, 00:42 JST). So brew upgrade brotli node (or node@24, node@22), then a restart of your Node processes, brings in all the fixes.
  • Bun. Bun 1.4.4, released on October 22 at 19:11 JST, builds brotli v1.2.1. The commit that moved it there says "Fixes #46352", the issue that reported Bun's brotli lacked the fix, and the release notes' Security section lists Brotli among what its fixes affect. The release notes don't name CVE-2026-111497 (checked October 23, 00:36 JST). Run bun upgrade.
  • Cloudflare Workers. Workers runs Cloudflare's own runtime, workerd, not Node.js. Cloudflare's docs say that in Workers, node:zlib "provides compression functionality implemented using Gzip, Deflate/Inflate, and Brotli". Cloudflare has published no statement about CVE-2026-111497: none in its developer changelog through October 22 or on its blog (checked October 23, 00:43 JST). Whether Workers is affected is not known.

Is your app reachable?

Node.js doesn't decode Brotli on its own; your code or a library has to hand it Brotli data. Whether that data can come from someone else decides how soon you need the update. Each row's "yes" is from the code or docs named in it (checked October 22, 11:56–12:29 JST).

What your code doesDoes outside Brotli data reach the decoder?What to do
An Express 5 server that parses JSON or form bodiesYes, by default. Express 5.3.0 depends on body-parser 2.x; body-parser added Brotli in 2.0.0, and its inflate option "Defaults to true"Update Node.js. Until you can, body-parser's inflate: false rejects compressed bodies
An Express 4 server using Express's built-in parsers (body-parser 1.x)Not through body-parser: 1.x has no Brotli support. If your package.json lists body-parser 2.x itself, the row above appliesUpdate Node.js anyway, for the TLS and DNS fixes
fetch(), axios, got, or node-fetch calls to URLs you don't control: link previews, scrapers, webhook senders, AI agents, and MCP servers that fetch web pagesYes. Each decompresses responses sent with Content-Encoding: br by default: Node's fetch() (undici), axios unless decompress: false, got (decompress defaults to true), and node-fetch (compress defaults to true)Update Node.js. A firewall in front of your app doesn't see these responses
Self-hosted Next.js with image optimizationYes, per Vercel: "Next.js does not block Brotli responses in image optimization"Update Node.js
zlib.brotliDecompress() or createBrotliDecompress() on data from outsideYesUpdate Node.js
Node that only runs your own build tools on your own codeOnly if a step downloads Brotli data from elsewhereUpdate at your next routine change

An app an AI coding agent wrote for you can sit in the first or third row without you knowing. Search your code and package.json for express.json, express.urlencoded, express.raw, express.text, bodyParser, fetch(, axios, got, node-fetch, and zlib.brotli to find out.

Platform status: what each host has said

This table holds only what each platform says on its own pages. It is the part of this page that goes stale first.

PlatformOwn statement? (checked Oct 23, JST)What it saysWhat you do
VercelYes: a Knowledge Base bulletin dated October 21 (00:43)WAF rules deployed the same day "block the inbound attack vector for every project on Vercel"; the WAF "does not cover responses your functions fetch from other servers". Patched runtimes are rolling out, and the page will be updated "as that completes"; no completion date is given. Projects on 22.x or 24.x "do not need to change their version setting"On Node 20, set 22.x or 24.x and redeploy. Rebuild container images you build yourself
AWS LambdaNo bulletin for this release; the newest AWS security bulletin, 2026-143, published October 22 at 06:30 JST, is about PHP (00:43)The Lambda docs say managed runtimes update automatically by default (Auto mode) in a two-phase rollout whose length varies with several factors, including "the severity of any security patches". Function update mode updates only when you update the function; Manual mode never does. Container images must be rebuilt from the updated base imageLog process.versions.node from the function. The INIT_START log line shows Lambda's own runtime version, whose numbers are "independent of the version numbers that the programming language uses". In Function update mode, redeploy. For container images, rebuild and redeploy. AWS hasn't said when the zip runtimes get 22.23.4 and 24.22.1 in each Region
NetlifyNo statement found in its Updates forum or changelog (00:43)The docs say the functions runtime follows the build's Node.js version, which "must be a valid AWS Lambda runtime for Node.js", and can be set with AWS_LAMBDA_JS_RUNTIMENetlify hasn't said when its functions get the fix. Move any site on Node 20 to 22 or 24
Cloudflare WorkersNo statement found in its developer changelog through October 22 or its blog (00:43)Workers runs workerd, not Node.js. The docs say node:zlib in Workers provides BrotliNot known yet. This row changes when Cloudflare says something

Where you install Node yourself, the channel decides when you get the fixed build:

Where your Node comes fromFixed build out? (checked Oct 23, 00:43 JST unless noted)How to get it
nodejs.org downloads, and nvm, which installs from https://nodejs.org/dist by defaultYes, since October 21, 19:38 JSTnvm install 22 (or 24, 26)
Docker Hub, official node imageYes: tags 22.23.4, 24.22.1, and 26.12.1 existdocker build --pull from node:22, node:24, node:26, or an exact tag. An image pinned to an older exact tag, such as node:24.22.0, stays on that version
NodeSource apt repositoryYes: 22.23.4-1nodesource1, 24.22.1-1nodesource1, 26.12.1-1nodesource1sudo apt-get update && sudo apt-get install nodejs
GitHub Actions setup-nodeYes: its versions manifest lists all three since October 21, 15:50 UTCSet check-latest: true, or pin the exact version. With the default false, setup-node takes a matching version from the runner's cache first. GitHub's Ubuntu 24.04 runner image still lists 22.23.3 and 24.21.0 in that cache, so node-version: 22 resolves to 22.23.3 there
HomebrewYes: node 26.12.1, node@24 24.22.1, and node@22 22.23.4, with bottles, since pull requests #320030, #320031, and #320032 merged on October 22 between 13:54 and 15:39 JST. They link brotli 1.2.1, which has had bottles since October 22, 10:29 JST (checked 00:42)brew upgrade brotli node (or node@24, node@22), then restart Node
DebianNot yet. The security tracker now lists CVE-2026-111497: it marks brotli vulnerable in bookworm, trixie, forky, and sid with no fixed version, and marks nodejs "unimportant" with the note "nodejs uses system provided brotli library" (checked 00:42)Watch the Brotli library package for this fix, and nodejs for the TLS and DNS fixes (see above)
UbuntuNo CVE page for CVE-2026-111497 (checked 00:45)Watch Ubuntu's CVE pages

Update Node.js and restart

1. Find the version you run

Run node -v on each machine and in each image, or log process.versions.node from the running app. You need 22.23.4, 24.22.1, 26.12.1, or later in the same line.

2. Check which Brotli library your Node uses

On Linux, run ldd "$(command -v node)" | grep -i brotli. On macOS, run otool -L "$(command -v node)" | grep -i brotli. A libbrotlidec line means your Node uses a separate Brotli library, so the Brotli fix comes from that library's package: your distribution's on Linux, or Homebrew's brotli (brew list --versions brotli should show 1.2.1). No output means the Brotli decoder is built into the Node binary.

3. Install a fixed build

With nvm, run nvm install 22 (or 24, 26), then nvm alias default 22. With NodeSource, run sudo apt-get update && sudo apt-get install nodejs. With Homebrew, run brew upgrade brotli node, or name node@24 or node@22 in place of node if you use one of those.

4. Rebuild everything that has Node inside it

Rebuild Docker images with docker build --pull, so the base image is fetched again rather than taken from your cache. Rebuild Lambda container images from the Lambda base image, and check node -v inside the result. Rebuild single executable applications (SEAs) and startup snapshots too: they carry the Node binary inside them, and CVE-2026-106074 is about them.

5. Restart every running process

A running process keeps the old Node binary in memory until it restarts. Restart pm2 apps, systemd services, and containers, then run step 1 again against the running app.

6. Move off Node 20 and Node 25

Neither line gets this fix or any later one. Move Node 20 apps to 22 or 24, and Node 25 apps to 26 or 24. On Vercel, that means changing the Node.js version in project settings or engines.node and redeploying.

Tell your users what you updated

Once the fixed build is running, the people who use your app may ask whether they need to do anything. Ask your coding agent to write the answer as one HTML page: that you moved to a fixed Node.js release, when you restarted, and what users should do, if anything.

Convika turns that file into a link: sign up free, drop the file on the upload screen, check the private preview, and publish. On the free plan the page is public: search engines and Convika's gallery may list it, so leave out exact versions, hostnames, IP addresses, and anything internal.

Publish my update page

The TLS and DNS fixes

Three of the High issues aren't about Brotli. Two let a TLS certificate check pass for the wrong host when the hostname is shaped like an IP address: CVE-2026-106069 on 22.x, 24.x, and 26.x, and CVE-2026-105483 on 24.x and 26.x only. The third, CVE-2026-105482, makes dns.resolve cut a name off at a NUL character. The same release also blocks the compromised eMudhra intermediate certificates: the advisory lists "ca-cert (eMudhra Intermediate CA Compromise)", and the release notes include pull request #66871, "tls: reject chains containing blocked public keys" (checked 12:01 JST). For your own website's certificate, eMudhra 中間証明書の問題：自分のサイトは対象？ (in Japanese) explains which certificates must be replaced and how to check who issued yours.

What not to do

  • Don't turn off certificate checks with rejectUnauthorized: false or NODE_TLS_REJECT_UNAUTHORIZED=0 if a connection fails after the update. That removes the check the TLS fixes repair.
  • Don't treat a web application firewall as the fix. Vercel, which deployed one, says it "reduces exposure but does not replace patching", and no firewall in front of your app sees the responses your own fetch() calls receive.
  • Don't count on npm audit. It "submits a description of the dependencies configured in your project" to the registry, and the Node.js runtime isn't one of them.

If what you built is only a page

Some things an AI agent builds are a single page and a sign-up form, with no server code of their own. A page published on Convika is HTML that Convika serves at a convika.page address or your own domain, and its scripts run in the visitor's browser, so there is no Node.js process of yours to update for this release (publish an HTML page, add a form without a backend). If what you built needs a server, a database, or a login, this doesn't apply, and the steps above do.

Updates to this page

  • October 23, 2026, 00:45 JST: CVE-2026-111497's CVSS 4.0 score, 9.2 (Critical), from Google as its CNA. Homebrew's node, node@24, and node@22 with the fixed versions. Bun 1.4.4 with the Brotli fix. Debian's tracker entry. The other platform and install rows were checked again and haven't changed.
  • October 22, 2026, 12:30 JST: first version.

This page changes when CVE.org publishes the other nine records, when Vercel finishes its runtime rollout, when AWS, Netlify, or Cloudflare publishes a statement, when Debian or Ubuntu ships a fix, when anything about exploitation is reported, and on October 28, when Node 26 becomes LTS.

Frequently asked questions

Which Node.js versions are affected by CVE-2026-111497?

Every 22.x before 22.23.4, every 24.x before 24.22.1, and every 26.x before 26.12.1, per the Node.js advisory of October 21, 2026. Node 20 and Node 25 are past end of life, and the advisory says end-of-life versions "are always affected".

Is Node.js 22 affected?

Yes. 22.x before 22.23.4 has CVE-2026-111497 and every other issue in this release except CVE-2026-105483, CVE-2026-106070, and CVE-2026-106071. Update to 22.23.4.

Do I need to update if my app runs on Vercel, AWS Lambda, or Cloudflare Workers?

On Vercel, projects on 22.x or 24.x don't change a setting, while Node 20 projects must move to 22.x or 24.x and redeploy. On AWS Lambda, managed runtimes in Auto mode update on their own, though AWS hasn't said when this fix arrives; Function update mode needs a redeploy, and container images need a rebuild. Cloudflare has made no statement as of October 23, 00:43 JST.

Is Node 20 still supported?

No. Node 20 reached end of life on April 30, 2026, and gets no fix for this release. Move to 22 or 24.

Does npm audit find this vulnerability?

No. npm audit checks the dependencies listed in your project, and the Node.js runtime isn't one of them. Check node -v instead.

Do I need to rebuild my Docker image?

Yes. An image keeps the Node it was built with. Rebuild with docker build --pull from node:22, node:24, or node:26, or from an exact fixed tag, then redeploy.

Am I affected if my code never uses Brotli?

Possibly. Node's fetch() decompresses Brotli responses, and Express 5 decompresses Brotli request bodies by default, so outside Brotli data can reach the decoder without your code naming Brotli.

Is CVE-2026-111497 being exploited?

No source this page checked on October 23, 00:41–00:43 JST, reports attacks in the wild: CISA's Known Exploited Vulnerabilities catalog doesn't list it, and neither the Node.js advisory nor Google's CVE record mentions attacks in the wild. Vercel's bulletin says researchers demonstrated command execution on unpatched versions.

What is the CVSS score of CVE-2026-111497?

9.2, Critical, in CVSS 4.0, with the vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Google assigned it as the CVE Numbering Authority when it published the record on October 22 at 22:35 JST, and the NVD shows the same score with none of its own (checked October 23, 00:41 JST). The Node.js project labels the bug High.

Sources

Times are in JST (UTC+9), on October 22, 2026, unless they say October 23.

Share this article