Node.js 22, 24 and 26: Security Updates Released
The security releases published on October 21, 2026 address important vulnerabilities in the Node.js ecosystem. Here is what changed, which versions to install, and how to update safely.
At a glance: The Node.js team published a security advisory covering 10 CVEs across the 22.x, 24.x and 26.x release lines. Four are rated High, three Medium, and three Low. Not every vulnerability affects every release line, so choosing the correct patched version matters.
Why does this security update matter?
Node.js is widely used for web application backends, APIs, automation workflows, and development tools. A vulnerability in the runtime can put systems at risk even when the application code itself has not changed.
The October 21, 2026 update addresses core areas including DNS resolution, TLS certificate validation, Brotli-compressed data handling, HTTP connection management, and the Permission Model. The highest reported severity is High. This does not mean every system has been compromised, but it does mean that affected environments should be patched promptly.
Which Node.js version should you update to?
The Node.js Project released the patched versions shown below. You can apply the security update within your current major release line. Moving to another major version may require additional compatibility testing.
Note: These are the patched releases from the October 21, 2026 security update. If a newer security patch is available, choose the latest supported patch in the same major release line.
Four notable high-severity vulnerabilities
Some vulnerabilities highlighted in the official advisory affect not just application logic, but also network and data layers handled directly by Node.js.
Brotli decoder: Memory corruption and remote code execution risk
Decoding malformed Brotli data can trigger an out-of-bounds memory write. Under certain conditions, attacker-controlled compressed data processed by an application may cause a crash, expose memory contents, or create a risk of remote code execution. Affected series: 22.x, 24.x and 26.x.
NUL character in DNS resolution
dns.resolve*() and dns.reverse() may truncate hostnames, causing the validated name to differ from the resolved destination. 22 / 24 / 26
Unicode IP notation in TLS validation
IP addresses written using full-width digits may bypass certificate hostname checks. 24 / 26
Nonstandard IPv4 addresses
IPv4 addresses with leading zeroes may cause the connection target and certificate validation to be interpreted differently on certain platforms. 22 / 24 / 26
Risk depends on how the service is used
For example, a service that decompresses untrusted Brotli input does not face the same exposure as one that processes only controlled internal data. Applying the security patch is still the right first step.
Other vulnerabilities and dependency updates
Alongside the high-severity issues, additional Medium- and Low-severity fixes were released:
- CVE-2026-105481 (Medium): A response received on a keep-alive HTTP socket before a request is sent may be mistakenly accepted as the response to a later request. 22 / 24 / 26
- CVE-2026-106072 (Medium): Incorrect certificate validation against DNS SANs when nonstandard IPv4 notation is used. 22 / 24 / 26
- CVE-2026-106074 (Medium): In startup snapshots, the caches for
crypto.randomUUID()andrandomInt()may produce repeated values across processes. 22 / 24 / 26 - CVE-2026-106070 (Low): Unexpected data may be returned when ZIP header validation fails. 26 only
- CVE-2026-106071 (Low): Wildcard file-access permissions in the Permission Model may be applied more broadly than intended. 26 only
- CVE-2026-106073 (Low):
fs.realpathSync()may allow Permission Model restrictions to be bypassed. 22 / 24 / 26
A safe update process for developers
When planning an update, check the Node.js versions running on servers, in Docker images, and in CI/CD environments—not just on your development machine.
Verify the active Node.js version
First, identify the versions running in development and production. Use the terminal command below to check the active runtime.
# Check the active Node.js version node --version # Check the installed npm version npm --version
Install the patch for your major version
If you use nvm, install the patch for your current major release as shown below. You do not need to run all three commands; choose the one that matches your project.
# Projects using Node.js 22 nvm install 22.23.4 # Projects using Node.js 24 nvm install 24.22.1 # Projects using Node.js 26 nvm install 26.12.1 # Example: Activate the installed 24.x version nvm use 24.22.1
Run dependency and compatibility tests
Run tests using the Node.js version that will actually power the application. Check unit tests, integration tests, TLS and external service connections, and compressed-content workflows.
Update production deployments
Review every deployment layer, including Docker base images, CI/CD runners, server packages, and process managers. Then redeploy the application or restart the relevant services.
Confirm the version actually running in production
After updating, verify the version of the running production process, not just your local terminal. Monitor logs and service health to confirm the rollout was successful.
Frequently asked questions about the Node.js update
I use Node.js 22, 24 or 26. Do I need to update?
If you are running an affected version, applying the security patch is strongly recommended. Test your application and dependency compatibility before updating.
Is updating npm packages enough?
No. This advisory addresses vulnerabilities in Node.js itself and components distributed with it. Updating npm dependencies does not change your Node.js runtime version.
What if I use an old, unsupported Node.js version?
Unsupported releases no longer receive new security patches. Plan a migration to a supported Node.js version and consult the official release schedule.
Is updating my development machine sufficient?
No. The version running in production is what matters most. Check Node.js versions in containers, servers, managed platforms, and CI/CD environments separately.
Official release notes and security advisory
This article is based on the Node.js Project security release dated October 21, 2026 and its related official release notes. Always check the latest security advisories before updating.
