Node.js October 2026 Security Update: A Practical Patch Guide

The Node.js project released security updates for the 22.x, 24.x, and 26.x release lines on October 21, 2026.

The release fixes ten vulnerabilities. Four are rated high severity, three medium, and three low. The issue getting the most attention is CVE-2026-111497, an out-of-bounds write in Node.js's Brotli decoder that can lead to process crashes, memory disclosure, or remote code execution.

The fix is available, but updating one version file is not enough.

Node.js may be installed in production servers, container images, background workers, build systems, CI runners, serverless environments, and local toolchains. A complete response requires teams to locate every affected runtime, replace it, redeploy the service, and verify what is actually running.

This guide focuses on that process.

Which Node.js versions contain the fixes?

The fixed versions published with the advisory are:

If you use one of these release lines, upgrade to the listed version or a newer secure release in the same supported line.

If you read this article after October 2026, confirm the latest version on the official Node.js website. Newer security and maintenance releases may already be available.

What makes the Brotli vulnerability serious?

Brotli is a compression format used across the web. Node.js applications can process Brotli data through the node:zlib module.

CVE-2026-111497 affects the bundled Brotli decoder. Specially formed compressed input can cause the decoder to write beyond the boundary of an internal buffer.

That type of memory corruption can have several outcomes:

• The Node.js process crashes.
• Data from process memory may be exposed.
• An attacker may be able to execute code within the affected process.

The important condition is whether an attacker can provide Brotli data that the application decompresses. A public web service, proxy, upload processor, or integration may create that path directly or indirectly.

Do not assume an application is unaffected simply because its own responses use gzip instead of Brotli. Review where the service accepts compressed content and how upstream systems transform traffic.

No published configuration change replaces the runtime update. The reliable remediation is to run a patched Node.js version.

The other high-severity issues

The same release fixes three additional high-severity vulnerabilities.

CVE-2026-105482: NUL characters in DNS names

The affected DNS functions could truncate a hostname at a NUL character when passing it to c-ares.

An application might validate one hostname but resolve another. For example, a string could appear to belong to an approved domain during validation while the resolver processes only the attacker-controlled part before the NUL character.

This can matter in systems that:

• Validate webhook destinations
• Use hostname allowlists
• Fetch remote resources
• Restrict server-side outbound requests
• Resolve user-provided domains

If a security decision depends on validating a hostname before resolving it, update the runtime and test that workflow.

CVE-2026-105483: Fullwidth digits in an IP address

Node.js TLS hostname verification could treat an IPv4 address written with certain non-ASCII digits as a DNS name instead of an IP address.

That difference could allow a certificate to pass a hostname check when it should be rejected.

This vulnerability affects Node.js 24.x and 26.x.

CVE-2026-106069: Non-canonical IPv4 notation

Another TLS issue involved hostnames that could be interpreted as IP addresses in different ways.

Node.js and the operating system resolver could normalize the same input differently. Under the right conditions, the application could connect to one address while validating the certificate against another.

This affects software that relies on Node.js hostname verification for outbound TLS connections.

A medium-severity issue worth checking separately

CVE-2026-106074 involves the entropy caches behind functions such as:

crypto.randomUUID()
crypto.randomUUIDv7()
crypto.randomInt()

When these functions are called while building a user-land startup snapshot or a single executable application that uses a snapshot, cached random values may be stored in the resulting artifact.

Processes created from that artifact can then produce the same early sequence of values.

This can lead to:

• UUID collisions between processes
• Repeated identifiers
• Values that are more predictable than expected
• Incorrect assumptions about uniqueness

The issue is most relevant when an application uses startup snapshots or Node.js single executable applications. Teams using those features should check whether random-value APIs run during the build phase.

Step 1: Build a runtime inventory

Before changing anything, list every environment that may contain Node.js.

Start with:

• Public APIs and web applications
• Internal services
• Queue consumers and background workers
• Scheduled jobs
• Serverless functions
• Container images
• CI/CD runners
• Build servers
• Preview and staging deployments
• Developer images used for reproducible builds

Run the following command inside each real environment:

node --version

Do not rely only on package.json:

{
  "engines": {
    "node": ">=22"
  }
}

That configuration describes an expected range. It does not prove which binary is running in production.

Record the service name, environment, current version, deployment method, owner, and required update. A small inventory table is enough if it covers every runtime.

Step 2: Locate every version pin

Node.js versions are often declared in more than one place.

Search for files and settings such as:

• .nvmrc
• .node-version
• package.json
• Dockerfile
• Docker Compose files
• CI workflow files
• Infrastructure-as-code templates
• Serverless runtime settings
• Kubernetes manifests
• Buildpack configuration

For example, a Dockerfile may contain:

FROM node:22.23.3-alpine

Updating .nvmrc will not change that image. The Dockerfile needs its own update, followed by a fresh build and deployment.

Avoid broad version tags if your release process requires reproducible builds. Pin a patched version or an approved immutable image digest, then manage future updates through your normal dependency process.

Step 3: Rebuild instead of restarting

Restarting a container does not install a newer Node.js binary. It starts the same image again.

For containerized services:

1. Update the base-image reference.
2. Pull the current base image.
3. Rebuild the application image.
4. Run tests against the new image.
5. Push the new artifact.
6. Deploy it.
7. Verify the Node.js version inside the running container.

Be careful with cached build layers. A successful image build does not always prove that the intended base image was downloaded.

Step 4: Test the areas affected by the release

Run the application's normal test suite, then focus on behavior connected to the patched components.

Useful test areas include:

• Compressed request and response handling
• File uploads containing compressed content
• DNS resolution of user-provided hostnames
• Outbound HTTPS requests
• Certificate and hostname validation
• Keep-alive connection reuse
• Random UUID and integer generation
• Startup snapshots
• Single executable builds
• Permission Model filesystem rules
• ZIP processing in Node.js 26

You do not need to create exploit code to validate the update. Confirm the new runtime, run functional and regression tests, and ensure the application still behaves correctly.

Step 5: Deploy and verify the live process

After deployment, check the running environment again:

node --version

For containers, run the command inside the deployed container rather than on the host.

Also verify every replica and worker group. A rolling deployment can leave an old instance running if the rollout stalls or a health check fails.

Useful post-deployment checks include:

• All replicas report the patched version.
• Old container images are no longer serving traffic.
• Background workers were restarted with the new artifact.
• Scheduled jobs use the updated runtime.
• Error and crash rates remain normal.
• Core HTTP and TLS workflows still pass.

The task is complete only when the production runtime has been verified.

What about Node.js 20 and older versions?

Node.js 20 and earlier release lines are not part of this security update.

That does not mean they are protected. It means they are outside the supported lines receiving these fixes.

If an application still depends on an end-of-life Node.js release, create a migration plan to a supported major version. Include:

• Dependency compatibility checks
• Framework compatibility checks
• Automated tests
• Staging validation
• Performance checks
• A rollback plan
• A production migration date

Installing the last available patch for an unsupported release does not address vulnerabilities discovered after support ended.

Common incomplete fixes

Updating local development only

The developer sees a patched version, but the deployment image still contains the vulnerable binary.

Updating the main API but not its workers

The web service is patched while queue consumers and scheduled jobs continue using an older image.

Merging the update without deploying it

The repository is correct, but production still runs the previous build.

Rebuilding from a cached base image

The build completes successfully while preserving an outdated runtime layer.

Ignoring CI runners

Production is patched, but build systems continue processing repositories and network data with an affected runtime.

Waiting for evidence of exploitation

Security patching should be based on confirmed exposure to a vulnerable version, not on whether the team has already noticed an incident.

A concise remediation checklist

• [ ] Read the official Node.js advisory.
• [ ] Identify every Node.js runtime in production and supporting systems.
• [ ] Upgrade Node.js 22, 24, and 26 to fixed versions.
• [ ] Plan migration for end-of-life release lines.
• [ ] Update container base images and CI configurations.
• [ ] Rebuild all affected artifacts.
• [ ] Run functional and regression tests.
• [ ] Deploy through the normal release process.
• [ ] Verify the runtime inside every live environment.
• [ ] Record the completed update and remaining exceptions.
• [ ] Monitor application health after deployment.

Final thoughts

CVE-2026-111497 makes the October 2026 Node.js release an important update, but the broader lesson is about runtime management.

Teams often know which Node.js version they intend to use. Security incidents expose the gap between intended versions and deployed versions.

A dependable patching process closes that gap:

1. Inventory every runtime.
2. Update every version pin.
3. Rebuild affected artifacts.
4. Test the application.
5. Deploy the update.
6. Verify the live process.

The version change may take a few minutes. Proving that no affected runtime remains is the part that requires discipline.