Node.js Oct 2026 Security: 26.12.1 and Node 26 LTS

On 21 October 2026 the Node.js project released security versions across all three supported lines at once - 26.12.1 (Current), 24.22.1 and 22.23.4 (both LTS).[1][2][3][4] This is not a routine patch bump you can batch with your next maintenance window. It ships four HIGH-severity CVEs, three of them reachable on a normally configured server without any unusual feature. Three affect the 26.x, 24.x and 22.x lines; one of them - the fullwidth-digit TLS bypass - only touches 26.x and 24.x. If you run any of them on a VPS, you are in scope - and you should treat the update as a security incident response, not a version refresh.[1]

This is the upgrade guide: what each release fixes per line, why these patches are mandatory right now, what the Node 26 → Active LTS transition on 28 October means for your upgrade plan, and the exact commands to check and update a self-hosted Node deployment.

What shipped on 21 October

The October 2026 security release covers Node.js 26.x, 24.x and 22.x, updating a set of bundled dependencies that includes c-ares on all three lines, OpenSSL on 24.x and 22.x, SQLite on 22.x, Undici on all three, and the root CA bundle (ca-cert) across the board - the latter responding to the eMudhra Intermediate CA compromise.[1]

The four HIGH-severity CVEs are the ones to understand, because each is a different class of problem:

CVE-2026-105482 - DNS resolution silently truncates names containing a NUL byte (HIGH)

dns.resolve*() and dns.reverse() truncate a hostname at any embedded NUL character instead of rejecting it.[1][5] Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example actually queries attacker.example and returns its records - no error. An application that validates a hostname against an allowlist and then resolves it with dns.resolve*() can act on records for a different name than the one it validated. This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Affects 26.x, 24.x, 22.x.[1][5]

CVE-2026-105483 - TLS hostname bypass with fullwidth digits (HIGH)

When an IPv4 address is written with non-ASCII fullwidth digits (such as １２７.0.0.1), tls.checkServerIdentity() does not recognize it as an IP address, normalizes it to a regular IP, and matches it against the certificate’s DNS names and Common Name instead of its IP-Address SANs. A certificate containing DNS:127.0.0.1 or DNS:*.0.0.1 can therefore authenticate a connection to an IP endpoint it was not issued for. This is a regression introduced after the fix for CVE-2026-48618. Affects 26.x and 24.x only - not 22.x.[1][6]

CVE-2026-106069 - TLS hostname bypass with a leading-zero IPv4 literal (HIGH)

For a non-canonical IPv4 literal with a leading zero such as 0127.0.0.1, tls.checkServerIdentity() follows WHATWG URL rules and reads the leading-zero octet as octal (becoming 87.0.0.1), while the operating-system resolver on platforms such as macOS reads it as decimal (127.0.0.1). A server at the connected address can be authenticated with a certificate issued for another IP. Affects 26.x, 24.x and 22.x.[1][2][3][4]

CVE-2026-111497 - Brotli decoder out-of-bounds write, remote code execution (HIGH)

The Brotli decoder bundled with Node.js writes past the end of an internal buffer on malformed compressed input, which can corrupt process memory and lead to a crash, disclosure, or remote code execution. It is reachable over HTTP whenever an application decompresses Brotli data through node:zlib - either from the request side (e.g. an Express route decoding a Content-Encoding: br body) or from the response side (built-in fetch() transparently decoding a Brotli response). Affects 26.x, 24.x, 22.x.[1] Because this is the most severe and broadly reachable of the batch, we cover its mechanics and the check/upgrade procedure for your specific VPS in a dedicated guide - see Node2Shell (CVE-2026-111497). This article covers it as part of the October release and the upgrade that closes it.[1][8]

The rest, briefly

Beyond the four HIGH fixes, the release also closes a set of medium and low issues you should know about even if they are lower risk:

• CVE-2026-105481 (medium) - an HTTP Agent keep-alive socket can process a response written before the request was sent; incomplete fix of CVE-2026-48931. All lines.[1]
• CVE-2026-106072 (medium) - a certificate with only a DNS SAN can authenticate an IP endpoint when the host is a non-canonical IPv4 spelling (0177.0.0.1, 0x7f.0.0.1, 2130706433, 127.1), on resolvers such as glibc. All lines.[1]
• CVE-2026-106074 (medium) - crypto.randomUUID() / randomInt() entropy caches are saved into user-land startup snapshots and single-executable apps, so every process from that snapshot repeats the same values (up to 127 UUIDs, ~1,000 randomInt() values). All lines.[1]
• CVE-2026-106070 (low) - zlib.ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation; 26.x only.[1]
• CVE-2026-106071 (low) - Permission Model wildcard radix lookup can over-grant filesystem access (e.g. --allow-fs-read=/etc/passwd.* also allows /etc/passwd); 26.x only.[1]
• CVE-2026-106073 (low) - fs.realpathSync() bypasses Permission Model read checks; incomplete fix of CVE-2026-21715. All lines.[1]

Which fix lands on which line

The dependency updates are line-specific, and the 22.x line is intentionally narrower than 26.x/24.x:[1][2][3][4]

Two practical takeaways from the table. First, 22.23.4 does not carry the CVE-2026-105483 fullwidth-digit fix - make sure you understand which bypasses your line actually closes if you are staying on 22.x. Second, the TLS validation hardening is real: all three patched releases now reject non-canonical IP addresses outright (fixing CVE-2026-106069 and CVE-2026-106072 together) rather than merely normalizing them.[2][3][4]

Why you should not defer this one

Three of the four HIGH-severity fixes touch code a plain Node process runs by default: DNS resolution via dns (CVE-2026-105482), TLS certificate verification on any https/tls connection (CVE-2026-105483, CVE-2026-106069), and Brotli decompression through node:zlib (CVE-2026-111497).[1] You do not need a niche feature or a specific framework to be in scope - a stock Node HTTPS client or server exercising the affected paths is enough.

This is also the second security-tagged release for the get-the-fix-right pattern: CVE-2026-105482 and CVE-2026-105481 are incomplete fixes of earlier CVEs that only covered part of the same code path, and CVE-2026-106074 is a cryptographic-entropy problem (predictable UUIDs / random values across processes) that is easy to under-rate. None of these gets closed by fiddling with your app code; they are runtime-level bugs in the bundled dependencies and core modules. The only action is the version bump.[1][5]

The Node 26 → Active LTS transition on 28 October

There is a second reason to do this upgrade deliberately rather than hurriedly: it lands in the middle of the Node release schedule pivoting to Node.js 26 becoming Active LTS on 28 October 2026.[7][9]

As of this release, on the project’s own release page:[7][9]

• v26 was released 5 May 2026 and is currently Current; it becomes Active LTS on 28 October 2026 and reaches end-of-life 30 April 2029.
• v24 (Krypton, released 6 May 2025) has been in Maintenance since 20 October 2026 - its Active-support period ended that day - reaching end-of-life 30 April 2028.
• v22 (Jod, released 24 April 2024) is already in Maintenance LTS (since October 2025) and reaches end-of-life 30 April 2027.

The project’s guidance is unambiguous: production applications should only use Active LTS or Maintenance LTS releases.[7] That matters for one reason: if you have been treating “24.22.0” as your active production line, that line flipped from Active to Maintenance on 20 October - it still gets security fixes (24.22.1 is exactly that), but only critical and security fixes, and its end of life is under 18 months away.[9] Node 26 becomes the Active LTS line in a few days, which makes it the natural upgrade target for anyone currently on 24.x or 22.x.

We cover the cadence change (and what the annual cycle means from Node 27 onward) in detail in Node.js Annual LTS Cycle. The short version for this window: 26.12.1 is the security-fixed version of the incoming Active LTS line - upgrading to it now does double duty, closing the October CVEs and putting you on the line that becomes production-recommended on 28 October.[9]

How to check what you are running, and upgrade on a self-hosted VPS

Start by checking the actual runtime in production - not what you think your Dockerfile or nvmrc says, but what is serving traffic:

# What the running process uses (pm2):
pm2 describe <app-name> | grep -i "exec cwd\|node"
node -v
# Expected: v26.12.1, v24.22.1, or v22.23.4 - anything else is in scope for the Oct 2026 release.

If you manage Node with nvm (the most common setup on a single-tenant VPS):

# See the exact set of versions and what's current globally:
nvm ls
nvm ls-remote --lts   # npm-sourced list is fine to confirm the latest LTS patch

# Install the security-fixed versions:
nvm install 26.12.1
# or, for the LTS-maintained lines:
nvm install 24.22.1
nvm install 22.23.4

# Point the shell-managed default at your chosen line:
nvm alias default 26.12.1

If you run Node from a direct binary tarball (a common pattern on minimal VPSes and in Dockerfiles built from a base image):

# Download + unpack the fixed version (adapt arch/version as needed):
wget https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-x64.tar.xz
sudo tar -xJf node-v26.12.1-linux-x64.tar.xz -C /usr/local --strip-components=1
node -v   # confirm v26.12.1

Verify the binary is actually serving - a version bump only counts when the process restarted onto it. With pm2:

pm2 startOrReload ecosystem.config.js     # or: pm2 reload all
pm2 restart <app-name>                    # a clean restart, not just a reload
pm2 describe <app-name> | grep -i uptime  # confirm the old pid is gone
node -v

For a security patch specifically, restart, do not rely on a graceful reload alone if you want the new binary guaranteed on new connections - a plain pm2 reload re-uses workers; a restart forks fresh ones onto the new runtime.

If you are upgrading through Linux distro packages (e.g. Ubuntu’s nodejs), check that the repo actually carries a fixed version before assuming apt upgrade solves it - distro-packaged Node is frequently an older, now-vulnerable line. In that case prefer the official nodejs.org binary or nvm rather than sitting on an in-scope build.

The short version

On 21 October 2026 Node.js shipped a security release across 26.12.1 (Current), 24.22.1 and 22.23.4 (both LTS), closing four HIGH-severity CVEs - CVE-2026-105482 (DNS NUL-byte truncation), CVE-2026-105483 and CVE-2026-106069 (two TLS hostname bypasses), and CVE-2026-111497 (Brotli out-of-bounds write → remote code execution) - plus six more medium/low fixes and bundled-dependency updates (c-ares, OpenSSL, SQLite, Undici, root CA bundle / eMudhra).[1] Three of the four HIGH fixes live in code a default Node process runs, so any 26.x/24.x/22.x host is in scope, and the incompleteness-of-previous-fix pattern plus a cryptographic-entropy CVE make this a mandatory security upgrade, not a routine bump. Node 26 becomes Active LTS on 28 October 2026 - 26.12.1 is the security-fixed version of the incoming production line - while 24.x moves to Maintenance and 22.x heads toward end-of-life in April 2027.[7][9] Check with node -v, upgrade via nvm or the official tarball, and restart your pm2-managed app so the fixed binary is actually the one serving traffic.

Sources

1. Node.js - “Wednesday, October 21, 2026 Security Releases” (security advisory: releases on 26.x/24.x/22.x; dependency updates c-ares/ca-cert eMudhra/OpenSSL/SQLite/Undici; CVEs 105482, 105483, 106069, 111497, 105481, 106072, 106074, 106070, 106071, 106073 with affected lines). https://nodejs.org/en/blog/vulnerability/october-2026-security-releases - checked 2026-10-26
2. Node.js - release notes, v26.12.1 (Current, security release, 2026-10-21; c-ares 1.34.9, Undici 8.12.2, NSS 3.131.1; fixes High CVE-2026-106069/106072, 105482, 105483, 111497; Low 106070, 106071). https://nodejs.org/en/blog/release/v26.12.1/ - checked 2026-10-26
3. Node.js - release notes, v24.22.1 ‘Krypton’ (LTS, security release, 2026-10-21; OpenSSL 3.5.9, c-ares 1.34.9, Undici 7.30.1, NSS 3.131.1; fixes High 106069/106072, 105482, 105483, 111497). https://nodejs.org/en/blog/release/v24.22.1/ - checked 2026-10-26
4. Node.js - release notes, v22.23.4 ‘Jod’ (LTS, security release, 2026-10-21; OpenSSL 3.5.9, SQLite 3.53.4, c-ares 1.34.9, Undici 6.29.1, NSS 3.131.1; fixes High 106069/106072, 105482, 111497; no CVE-2026-105483). https://nodejs.org/en/blog/release/v22.23.4/ - checked 2026-10-26
5. Node.js - CVE-2026-105482 description (dns.resolve*/dns.reverse NUL truncation; incomplete fix of CVE-2026-48930). https://nodejs.org/en/blog/vulnerability/october-2026-security-releases - checked 2026-10-26
6. Node.js - CVE-2026-105483 description (fullwidth-digit IP TLS hostname bypass; regression after CVE-2026-48618 fix; affects 26.x/24.x). https://nodejs.org/en/blog/vulnerability/october-2026-security-releases - checked 2026-10-26
7. Node.js - “Node.js Releases” (previous releases page: v26 released 2026-05-05 Current, v24 Krypton LTS released 2026-05-06, v22 Jod LTS released 2024-04-24; “Production applications should only use Active LTS or Maintenance LTS releases”). https://nodejs.org/en/about/previous-releases - checked 2026-10-26
8. DeploySmith - Node2Shell (CVE-2026-111497): The Critical Brotli RCE and What to Patch on Your VPS (deep dive on the Brotli flaw, checks, and upgrade). https://deploysmith.dev/guides/node2shell-brotli-rce-vps/ - checked 2026-10-26
9. nodejs/Release working group - release schedule / schedule.json (v26 → Active LTS 2026-10-28, EOL 2029-04-30; v24 Krypton Active till 2026-10-20 then Maintenance, EOL 2028-04-30; v22 maintenance, EOL 2027-04-30); cross-checked with endoflife.date/nodejs. https://github.com/nodejs/Release ; https://endoflife.date/nodejs - checked 2026-10-26