{"id":799,"date":"2026-10-24T08:16:13","date_gmt":"2026-10-24T08:16:13","guid":{"rendered":"https:\/\/techparkcyprus.com\/?p=799"},"modified":"2026-10-24T08:21:59","modified_gmt":"2026-10-24T08:21:59","slug":"node-js-22-24-ve-26-icin-guvenlik-guncellemeleri-yayimlandi","status":"publish","type":"post","link":"https:\/\/techparkcyprus.com\/index.php\/2026\/10\/24\/node-js-22-24-ve-26-icin-guvenlik-guncellemeleri-yayimlandi\/","title":{"rendered":"Node.js 22, 24 ve 26 i\u00e7in g\u00fcvenlik g\u00fcncellemeleri yay\u0131mland\u0131"},"content":{"rendered":"\n<style>\n#tp-node-2026{--tp-ink:#18232e;--tp-muted:#697584;--tp-line:#e7eaf0;--tp-orange:#ff9b00;--tp-orange-soft:#fff6e8;--tp-panel:#f7f8fa;--tp-blue:#17b5d8;--tp-card:#fff;font-family:Roboto,Arial,Helvetica,sans-serif;color:var(--tp-ink);background:#fff;width:100%;line-height:1.74;font-size:16px;overflow-wrap:break-word}\n#tp-node-2026 *,#tp-node-2026 *::before,#tp-node-2026 *::after{box-sizing:border-box}\n#tp-node-2026 a{color:inherit;text-decoration:none;transition:color .2s ease,background .2s ease,border-color .2s ease,transform .2s ease}\n#tp-node-2026 a:focus-visible,#tp-node-2026 summary:focus-visible{outline:3px solid var(--tp-orange);outline-offset:4px}\n#tp-node-2026 .tp-shell{width:min(1180px,calc(100% - 48px));margin-inline:auto}\n#tp-node-2026 .tp-hero{background:radial-gradient(circle at 88% 17%,rgba(255,155,0,.075),transparent 26%),linear-gradient(115deg,#fff 45%,#fbfcfd 100%);border-bottom:1px solid var(--tp-line);padding:75px 0 62px;overflow:hidden}\n#tp-node-2026 .tp-hero-grid{display:grid;grid-template-columns:minmax(0,1.13fr) minmax(350px,.87fr);align-items:center;gap:clamp(36px,6vw,85px)}\n#tp-node-2026 .tp-eyebrow{display:flex;align-items:center;gap:11px;font-size:11px;font-weight:800;letter-spacing:.17em;text-transform:uppercase;color:#677281;line-height:1.5}\n#tp-node-2026 .tp-dot{display:inline-block;height:8px;width:8px;flex-shrink:0;border-radius:50%;background:var(--tp-orange)}\n#tp-node-2026 .tp-hero h1{font-size:clamp(34px,3.5vw,55px);line-height:1.14;letter-spacing:-.046em;font-weight:800;margin:22px 0 23px;color:#17222e}\n#tp-node-2026 .tp-accent{color:#dc8500}\n#tp-node-2026 .tp-deck{font-size:17px;line-height:1.82;color:#667280;max-width:610px;margin:0 0 25px}\n#tp-node-2026 .tp-meta{display:flex;flex-wrap:wrap;align-items:center;gap:9px 14px;font-size:12px;color:#76818f;font-weight:600}\n#tp-node-2026 .tp-meta i{width:3px;height:3px;border-radius:50%;background:#b9c2cb;display:inline-block}\n#tp-node-2026 .tp-hero-visual{position:relative;background:#fff;border:1px solid #e8eaf0;border-radius:20px;padding:25px;box-shadow:0 28px 65px rgba(19,36,54,.065);min-width:0}\n#tp-node-2026 .tp-hero-visual::before{content:\"\";position:absolute;z-index:0;width:118px;height:118px;border:24px solid rgba(255,155,0,.095);border-radius:50%;top:-33px;right:-28px;pointer-events:none}\n#tp-node-2026 .tp-visual-top{display:flex;align-items:center;justify-content:space-between;gap:15px;position:relative;z-index:1;border-bottom:1px solid var(--tp-line);padding-bottom:20px;margin-bottom:15px}\n#tp-node-2026 .tp-node-mark{width:45px;height:45px;background:#17232d;color:#fff;border-radius:13px;display:grid;place-items:center;font-weight:900;font-size:19px;letter-spacing:-.09em}\n#tp-node-2026 .tp-mini-eyebrow{font-size:10px;letter-spacing:.13em;color:#87909d;font-weight:800;text-transform:uppercase}\n#tp-node-2026 .tp-visual-title{font-size:16px;font-weight:800;letter-spacing:-.025em;line-height:1.5}\n#tp-node-2026 .tp-signal{width:9px;height:9px;border-radius:50%;background:var(--tp-orange);box-shadow:0 0 0 5px rgba(255,155,0,.12)}\n#tp-node-2026 .tp-release-list{display:grid;gap:8px;position:relative;z-index:1}\n#tp-node-2026 .tp-release{display:flex;align-items:center;justify-content:space-between;gap:12px;background:#f9fafb;border:1px solid #f0f1f4;border-radius:10px;padding:13px 14px}\n#tp-node-2026 .tp-release b{display:block;font-size:13px;line-height:1.2;font-weight:800}\n#tp-node-2026 .tp-release small{display:block;color:#8a949f;font-size:11px;margin-top:4px}\n#tp-node-2026 .tp-version{white-space:nowrap;font-weight:800;font-size:14px;color:#303b46;font-variant-numeric:tabular-nums}\n#tp-node-2026 .tp-version em{font-style:normal;font-weight:800;font-size:10px;color:#bd7400;background:#fff2dc;border:1px solid #ffe5b6;border-radius:5px;margin-left:5px;padding:3px 5px}\n#tp-node-2026 .tp-visual-foot{display:flex;align-items:center;justify-content:space-between;gap:8px;padding-top:18px;margin-top:4px;font-size:11px;color:#7c8791}\n#tp-node-2026 .tp-visual-foot strong{font-size:11px;color:#a46100;font-weight:700}\n#tp-node-2026 .tp-article-grid{display:grid;grid-template-columns:220px minmax(0,1fr);gap:clamp(34px,5vw,76px);padding-top:64px;padding-bottom:65px;align-items:start}\n#tp-node-2026 .tp-sidebar{position:sticky;top:100px;border-left:1px solid var(--tp-line);padding:8px 0 6px 21px}\n#tp-node-2026 .tp-sidebar-title{font-size:11px;letter-spacing:.15em;text-transform:uppercase;color:#919aa5;font-weight:800;margin:0 0 18px}\n#tp-node-2026 .tp-sidebar a{display:block;font-size:13px;color:#727e8b;margin:0 0 13px;line-height:1.52;font-weight:600}\n#tp-node-2026 .tp-sidebar a:hover{color:#d88400}\n#tp-node-2026 .tp-sidebar .tp-source-chip{display:flex;align-items:center;gap:8px;border-top:1px solid var(--tp-line);margin-top:25px;padding-top:21px;color:#4e5e6c;font-weight:700}\n#tp-node-2026 .tp-main{min-width:0;max-width:840px}\n#tp-node-2026 .tp-main p{margin:0 0 18px;color:#5c6977;font-size:15.5px;line-height:1.89}\n#tp-node-2026 .tp-main p strong{color:#263442;font-weight:700}\n#tp-node-2026 .tp-intro{padding:24px 27px;border-radius:13px;border:1px solid #ffe7c3;background:linear-gradient(90deg,#fff9f0 0%,#fff 100%);margin:0 0 43px}\n#tp-node-2026 .tp-intro p{margin:0;font-size:16px;color:#455261}\n#tp-node-2026 .tp-section{scroll-margin-top:35px;margin-top:53px}\n#tp-node-2026 .tp-section:first-of-type{margin-top:0}\n#tp-node-2026 .tp-kicker{font-size:11px;line-height:1.3;color:#c87e10;font-weight:800;letter-spacing:.14em;text-transform:uppercase;margin:0 0 11px}\n#tp-node-2026 .tp-main h2{font-size:clamp(24px,2.4vw,33px);line-height:1.22;letter-spacing:-.035em;font-weight:800;color:#1c2834;margin:0 0 18px}\n#tp-node-2026 .tp-main h3{font-size:18px;line-height:1.4;letter-spacing:-.012em;font-weight:800;color:#24313c;margin:0 0 9px}\n#tp-node-2026 .tp-stats{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:11px;margin:26px 0 28px}\n#tp-node-2026 .tp-stat{border:1px solid #eceff2;border-radius:12px;background:#fff;padding:20px 19px;min-height:113px}\n#tp-node-2026 .tp-stat strong{display:block;font-size:33px;letter-spacing:-.055em;font-weight:800;color:#192632;line-height:1.15}\n#tp-node-2026 .tp-stat strong span{color:#e59218}\n#tp-node-2026 .tp-stat small{display:block;font-size:12px;margin-top:10px;color:#75818d;line-height:1.5}\n#tp-node-2026 .tp-versions{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:12px;margin:24px 0 17px}\n#tp-node-2026 .tp-ver-card{border:1px solid #e7eaf0;background:#fff;border-radius:13px;padding:20px 16px;min-width:0;transition:transform .2s ease,box-shadow .2s ease}\n#tp-node-2026 .tp-ver-card:hover{transform:translateY(-3px);box-shadow:0 12px 28px rgba(25,42,60,.06)}\n#tp-node-2026 .tp-ver-card small{display:block;color:#8994a0;font-size:11px;text-transform:uppercase;letter-spacing:.08em;font-weight:700}\n#tp-node-2026 .tp-ver-card strong{display:block;font-size:25px;letter-spacing:-.035em;color:#1b2733;margin-top:7px;white-space:nowrap}\n#tp-node-2026 .tp-ver-card span{display:inline-block;padding:3px 9px;background:#f4f6f8;border-radius:5px;font-size:11px;color:#687584;margin-top:9px}\n#tp-node-2026 .tp-ver-card a{display:inline-flex;align-items:center;margin-top:18px;padding-bottom:2px;border-bottom:1px solid #e3b46c;font-size:12px;font-weight:700;color:#9a640c}\n#tp-node-2026 .tp-ver-card a:hover{color:#794900;border-bottom-color:#794900}\n#tp-node-2026 .tp-note{font-size:12px!important;color:#89939e!important;line-height:1.68!important;margin:12px 0 0!important}\n#tp-node-2026 .tp-featured-risk{border:1px solid #f1d8b2;border-radius:14px;background:#fffcf8;padding:24px 25px;margin:24px 0 14px}\n#tp-node-2026 .tp-risk-head{display:flex;align-items:center;gap:10px;flex-wrap:wrap;margin-bottom:12px}\n#tp-node-2026 .tp-risk-label{background:#fff0d8;border-radius:5px;color:#9d6000;font-size:10px;font-weight:800;letter-spacing:.05em;padding:5px 8px}\n#tp-node-2026 .tp-cve{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;color:#8c6335;font-size:11px;overflow-wrap:anywhere}\n#tp-node-2026 .tp-featured-risk h3{font-size:20px;margin:0 0 9px}\n#tp-node-2026 .tp-featured-risk p{margin:0;font-size:14.5px}\n#tp-node-2026 .tp-risk-grid{display:grid;grid-template-columns:1fr 1fr;gap:11px;margin-top:12px}\n#tp-node-2026 .tp-risk-card{border:1px solid #e9edf0;background:#fff;border-radius:12px;padding:20px}\n#tp-node-2026 .tp-risk-card .tp-cve{display:block;margin-bottom:8px}\n#tp-node-2026 .tp-risk-card h3{font-size:16px;margin-bottom:8px}\n#tp-node-2026 .tp-risk-card p{font-size:13.5px;margin:0;line-height:1.72}\n#tp-node-2026 .tp-bullets{margin:22px 0 0;padding:0;list-style:none;display:grid;gap:12px}\n#tp-node-2026 .tp-bullets li{display:flex;align-items:flex-start;gap:11px;border-bottom:1px solid #eff1f4;padding-bottom:12px;color:#596674;font-size:14.5px;line-height:1.8}\n#tp-node-2026 .tp-bullets li:last-child{border-bottom:0;padding-bottom:0}\n#tp-node-2026 .tp-list-mark{flex-shrink:0;margin-top:10px;width:7px;height:7px;background:#ffc46c;border:1px solid #f8ac33;border-radius:50%}\n#tp-node-2026 .tp-bullets code,#tp-node-2026 p code{background:#f3f5f7;color:#364354;border-radius:4px;padding:2px 5px;font-size:.88em;overflow-wrap:anywhere}\n#tp-node-2026 .tp-soft-banner{border:1px solid #e7ebef;background:#f8fafb;border-radius:12px;padding:20px 23px;margin-top:20px}\n#tp-node-2026 .tp-soft-banner p{font-size:14px;margin:0}\n#tp-node-2026 .tp-steps{display:grid;gap:16px;margin:27px 0}\n#tp-node-2026 .tp-step{display:grid;grid-template-columns:42px 1fr;gap:15px;align-items:start}\n#tp-node-2026 .tp-step-num{width:40px;height:40px;border-radius:11px;background:#fff4e3;border:1px solid #ffebc9;color:#bd7609;display:grid;place-items:center;font-size:13px;font-weight:800}\n#tp-node-2026 .tp-step h3{margin:1px 0 5px;font-size:16px}\n#tp-node-2026 .tp-step p{margin-bottom:0;font-size:14.5px}\n#tp-node-2026 .tp-code{border-radius:12px;background:#1e2933;color:#f6f9fb;overflow:hidden;margin:18px 0 23px;border:1px solid #222f3b}\n#tp-node-2026 .tp-codebar{display:flex;align-items:center;justify-content:space-between;gap:10px;padding:12px 16px;border-bottom:1px solid rgba(255,255,255,.1);font-size:11px;color:#aeb9c3;font-weight:700}\n#tp-node-2026 .tp-window-dots{display:flex;gap:5px}\n#tp-node-2026 .tp-window-dots i{display:block;width:7px;height:7px;border-radius:50%;background:#627180}\n#tp-node-2026 .tp-window-dots i:first-child{background:#ff9b00}\n#tp-node-2026 .tp-code pre{margin:0;padding:18px 20px;font:13px\/1.95 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;overflow-x:auto;white-space:pre;color:#e5ecf2}\n#tp-node-2026 .tp-code .tp-comment{color:#99a9b6}\n#tp-node-2026 .tp-code .tp-command{color:#ffd39a}\n#tp-node-2026 .tp-faq{border-top:1px solid #e6ebee;margin-top:22px}\n#tp-node-2026 .tp-faq details{border-bottom:1px solid #e6ebee;padding:4px 0}\n#tp-node-2026 .tp-faq summary{padding:18px 30px 18px 0;cursor:pointer;position:relative;list-style:none;font-size:15px;font-weight:700;color:#283441}\n#tp-node-2026 .tp-faq summary::-webkit-details-marker{display:none}\n#tp-node-2026 .tp-faq summary::after{content:\"+\";position:absolute;right:3px;top:16px;color:#cb7f08;font-size:22px;font-weight:400;line-height:1}\n#tp-node-2026 .tp-faq details[open] summary::after{content:\"\u2212\"}\n#tp-node-2026 .tp-faq p{margin:0 0 20px;font-size:14px}\n#tp-node-2026 .tp-source-list{margin:20px 0 0;padding:0;list-style:none}\n#tp-node-2026 .tp-source-list li{border-bottom:1px solid #eef0f2;padding:10px 0;color:#5d6975;font-size:13.5px}\n#tp-node-2026 .tp-source-list a{color:#c27907;font-weight:700;border-bottom:1px solid #ffdba2}\n#tp-node-2026 .tp-source-list a:hover{color:#874e00}\n#tp-node-2026 .tp-bottom{padding:0 0 80px}\n#tp-node-2026 .tp-bottom-card{display:flex;align-items:center;justify-content:space-between;gap:24px;border:1px solid #e6e8ec;border-radius:17px;background:linear-gradient(110deg,#fff9ef 0%,#fff 65%);padding:29px 34px}\n#tp-node-2026 .tp-bottom-card small{display:block;text-transform:uppercase;color:#c07c19;letter-spacing:.13em;font-size:10px;font-weight:800;margin-bottom:6px}\n#tp-node-2026 .tp-bottom-card h2{font-size:22px!important;letter-spacing:-.03em!important;line-height:1.3!important;margin:0 0 8px!important}\n#tp-node-2026 .tp-bottom-card p{margin:0;color:#75808d;font-size:13px;max-width:560px;line-height:1.7}\n#tp-node-2026 .tp-btn{display:inline-flex;align-items:center;justify-content:center;gap:10px;background:#25313c;color:#fff!important;border:1px solid #25313c;border-radius:8px;padding:13px 17px;font-size:12px;font-weight:800;white-space:nowrap}\n#tp-node-2026 .tp-btn:hover{background:#e58b00;border-color:#e58b00;transform:translateY(-2px)}\n@media(max-width:1000px){#tp-node-2026 .tp-hero-grid{grid-template-columns:minmax(0,1fr) minmax(290px,.9fr);gap:35px}#tp-node-2026 .tp-article-grid{grid-template-columns:180px minmax(0,1fr);gap:32px}#tp-node-2026 .tp-ver-card strong{font-size:21px}}\n@media(max-width:780px){#tp-node-2026 .tp-shell{width:min(100% - 36px,700px)}#tp-node-2026 .tp-hero{padding:51px 0 46px}#tp-node-2026 .tp-hero-grid{grid-template-columns:1fr;gap:36px}#tp-node-2026 .tp-hero h1{max-width:680px}#tp-node-2026 .tp-hero-visual{max-width:570px;width:100%}#tp-node-2026 .tp-article-grid{display:block;padding-top:41px;padding-bottom:43px}#tp-node-2026 .tp-sidebar{position:static;border-left:0;border-bottom:1px solid var(--tp-line);padding:0 0 19px;margin-bottom:34px}#tp-node-2026 .tp-sidebar-title{margin-bottom:9px}#tp-node-2026 .tp-sidebar a{display:inline-block;margin:4px 15px 4px 0;font-size:12px}#tp-node-2026 .tp-sidebar .tp-source-chip{display:none}#tp-node-2026 .tp-section{margin-top:43px}#tp-node-2026 .tp-bottom{padding-bottom:55px}}\n@media(max-width:520px){#tp-node-2026 .tp-shell{width:calc(100% - 30px)}#tp-node-2026 .tp-hero{padding:39px 0 37px}#tp-node-2026 .tp-eyebrow{letter-spacing:.11em;font-size:10px}#tp-node-2026 .tp-hero h1{font-size:33px;margin:17px 0 18px}#tp-node-2026 .tp-deck{font-size:15px;line-height:1.75}#tp-node-2026 .tp-hero-visual{padding:18px;border-radius:15px}#tp-node-2026 .tp-version{font-size:12px}#tp-node-2026 .tp-release{padding:11px 10px}#tp-node-2026 .tp-main p{font-size:14.5px}#tp-node-2026 .tp-intro{padding:18px}#tp-node-2026 .tp-intro p{font-size:14.5px}#tp-node-2026 .tp-main h2{font-size:25px}#tp-node-2026 .tp-stats{gap:7px}#tp-node-2026 .tp-stat{padding:14px 11px;min-height:102px}#tp-node-2026 .tp-stat strong{font-size:26px}#tp-node-2026 .tp-stat small{font-size:10px}#tp-node-2026 .tp-versions{grid-template-columns:1fr;gap:8px}#tp-node-2026 .tp-ver-card{display:grid;grid-template-columns:1fr auto;gap:0 8px;padding:15px}#tp-node-2026 .tp-ver-card small{grid-column:1}#tp-node-2026 .tp-ver-card strong{font-size:23px;grid-column:1}#tp-node-2026 .tp-ver-card span{grid-column:2;grid-row:2;align-self:center;margin-top:3px}#tp-node-2026 .tp-ver-card a{grid-column:1 \/ -1;margin-top:8px}#tp-node-2026 .tp-risk-grid{grid-template-columns:1fr}#tp-node-2026 .tp-featured-risk{padding:18px}#tp-node-2026 .tp-bottom-card{flex-direction:column;align-items:flex-start;padding:22px}#tp-node-2026 .tp-btn{width:100%}#tp-node-2026 .tp-step{grid-template-columns:34px 1fr;gap:12px}#tp-node-2026 .tp-step-num{width:32px;height:32px;border-radius:9px}}\n@media(prefers-reduced-motion:reduce){#tp-node-2026 a,#tp-node-2026 .tp-ver-card{transition:none!important}}\n<\/style>\n\n<article id=\"tp-node-2026\" lang=\"tr\" aria-label=\"Node.js Ekim 2026 g\u00fcvenlik g\u00fcncellemeleri\">\n  <header class=\"tp-hero\">\n    <div class=\"tp-shell tp-hero-grid\">\n      <div>\n        <div class=\"tp-eyebrow\"><span class=\"tp-dot\" aria-hidden=\"true\"><\/span> TECHPARK \/ DEVELOPMENT \/ SECURITY<\/div>\n        <h1>Node.js 22, 24 ve 26 i\u00e7in <span class=\"tp-accent\">g\u00fcvenlik g\u00fcncellemeleri<\/span> yay\u0131mland\u0131<\/h1>\n        <p class=\"tp-deck\">21 Ekim 2026 tarihli g\u00fcvenlik s\u00fcr\u00fcmleri, Node.js ekosistemindeki \u00f6nemli a\u00e7\u0131klara \u00e7\u00f6z\u00fcm getiriyor. Hangi s\u00fcr\u00fcme ge\u00e7meniz gerekti\u011fini, \u00f6ne \u00e7\u0131kan riskleri ve g\u00fcncelleme s\u00fcrecini birlikte inceleyelim.<\/p>\n        <div class=\"tp-meta\"><span>24 Ekim 2026<\/span><i aria-hidden=\"true\"><\/i><span>Development<\/span><i aria-hidden=\"true\"><\/i><span>Yakla\u015f\u0131k 7 dakika okuma<\/span><\/div>\n      <\/div>\n      <div class=\"tp-hero-visual\" aria-label=\"G\u00fcncellenmi\u015f Node.js s\u00fcr\u00fcmleri\">\n        <div class=\"tp-visual-top\">\n          <div style=\"display:flex;align-items:center;gap:12px\"><div class=\"tp-node-mark\" aria-hidden=\"true\">N.<\/div><div><div class=\"tp-mini-eyebrow\">21 OCT 2026<\/div><div class=\"tp-visual-title\">Security release overview<\/div><\/div><\/div>\n          <span class=\"tp-signal\" aria-hidden=\"true\"><\/span>\n        <\/div>\n        <div class=\"tp-release-list\">\n          <div class=\"tp-release\"><div><b>Node.js 22.x<\/b><small>Long-Term Support<\/small><\/div><div class=\"tp-version\">v22.23.4 <em>FIXED<\/em><\/div><\/div>\n          <div class=\"tp-release\"><div><b>Node.js 24.x<\/b><small>Long-Term Support<\/small><\/div><div class=\"tp-version\">v24.22.1 <em>FIXED<\/em><\/div><\/div>\n          <div class=\"tp-release\"><div><b>Node.js 26.x<\/b><small>Current<\/small><\/div><div class=\"tp-version\">v26.12.1 <em>FIXED<\/em><\/div><\/div>\n        <\/div>\n        <div class=\"tp-visual-foot\"><span>Security bulletin \/ October 2026<\/span><strong>HIGH \u00b7 En y\u00fcksek \u00f6nem<\/strong><\/div>\n      <\/div>\n    <\/div>\n  <\/header>\n\n  <div class=\"tp-shell tp-article-grid\">\n    <nav class=\"tp-sidebar\" aria-label=\"Yaz\u0131 i\u00e7indekiler\">\n      <div class=\"tp-sidebar-title\">\u0130\u00c7\u0130NDEK\u0130LER<\/div>\n      <a href=\"#tp-neden\">G\u00fcncelleme neden \u00f6nemli?<\/a>\n      <a href=\"#tp-surumler\">G\u00fcncel s\u00fcr\u00fcmler<\/a>\n      <a href=\"#tp-aciklar\">\u00d6ne \u00e7\u0131kan g\u00fcvenlik a\u00e7\u0131klar\u0131<\/a>\n      <a href=\"#tp-diger\">Di\u011fer d\u00fczeltmeler<\/a>\n      <a href=\"#tp-adimlar\">Nas\u0131l g\u00fcncellenir?<\/a>\n      <a href=\"#tp-sss\">S\u0131k sorulan sorular<\/a>\n      <a href=\"#tp-kaynaklar\">Resm\u00ee kaynaklar<\/a>\n      <a class=\"tp-source-chip\" href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" target=\"_blank\" rel=\"noopener noreferrer\"><span class=\"tp-dot\" aria-hidden=\"true\"><\/span> Node.js duyurusu<\/a>\n    <\/nav>\n\n    <div class=\"tp-main\">\n      <div class=\"tp-intro\"><p><strong>K\u0131sa \u00f6zet:<\/strong> Node.js ekibi, 22.x, 24.x ve 26.x s\u00fcr\u00fcm serileri i\u00e7in toplam <strong>10 CVE<\/strong> i\u00e7eren bir g\u00fcvenlik duyurusu yay\u0131mlad\u0131. Bunlar\u0131n d\u00f6rd\u00fc <strong>y\u00fcksek (High)<\/strong>, \u00fc\u00e7\u00fc orta (Medium), \u00fc\u00e7\u00fc d\u00fc\u015f\u00fck (Low) \u00f6nem seviyesinde. Her a\u00e7\u0131kl\u0131k her s\u00fcr\u00fcm serisini etkilemiyor; bu nedenle do\u011fru d\u00fczeltme s\u00fcr\u00fcm\u00fcn\u00fc kullanmak kritik.<\/p><\/div>\n\n      <section id=\"tp-neden\" class=\"tp-section\">\n        <div class=\"tp-kicker\">01 \/ GENEL BAKI\u015e<\/div>\n        <h2>Bu g\u00fcvenlik g\u00fcncellemesi neden \u00f6nemli?<\/h2>\n        <p>Node.js; web uygulamalar\u0131n\u0131n arka u\u00e7 servislerinde, API altyap\u0131lar\u0131nda, otomasyon s\u00fcre\u00e7lerinde ve geli\u015ftirme ara\u00e7lar\u0131nda yayg\u0131n olarak kullan\u0131l\u0131yor. \u00c7al\u0131\u015fma zaman\u0131ndaki bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131, uygulama kodu de\u011fi\u015fmemi\u015f olsa bile sistemlerin risk alt\u0131nda kalmas\u0131na neden olabilir.<\/p>\n        <p>21 Ekim 2026 g\u00fcncellemesi; <strong>DNS \u00e7\u00f6z\u00fcmleme, TLS sertifika kontrol\u00fc, Brotli s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f veri i\u015fleme, HTTP ba\u011flant\u0131 y\u00f6netimi ve izin modeli<\/strong> gibi temel alanlara odaklan\u0131yor. En y\u00fcksek \u00f6nem seviyesi High olarak duyuruldu. Bu, t\u00fcm sistemlerin mutlaka s\u00f6m\u00fcr\u00fcld\u00fc\u011f\u00fc anlam\u0131na gelmez; ancak etkilenen ortamlarda g\u00fcncellemenin geciktirilmemesi gerekti\u011fini g\u00f6sterir.<\/p>\n        <div class=\"tp-stats\" aria-label=\"G\u00fcvenlik duyurusu istatistikleri\">\n          <div class=\"tp-stat\"><strong>3<span>\u00d7<\/span><\/strong><small>G\u00fcncellenen ana s\u00fcr\u00fcm serisi<\/small><\/div>\n          <div class=\"tp-stat\"><strong>10<\/strong><small>Duyuruda ele al\u0131nan CVE<\/small><\/div>\n          <div class=\"tp-stat\"><strong>4<\/strong><small>Y\u00fcksek \u00f6nem seviyeli a\u00e7\u0131k<\/small><\/div>\n        <\/div>\n      <\/section>\n\n      <section id=\"tp-surumler\" class=\"tp-section\">\n        <div class=\"tp-kicker\">02 \/ S\u00dcR\u00dcM REHBER\u0130<\/div>\n        <h2>Hangi Node.js s\u00fcr\u00fcm\u00fcne g\u00fcncellemelisiniz?<\/h2>\n        <p>Node.js Project taraf\u0131ndan yay\u0131mlanan d\u00fczeltme s\u00fcr\u00fcmleri a\u015fa\u011f\u0131daki gibidir. Mevcut ana s\u00fcr\u00fcm\u00fcn\u00fcz\u00fc koruyarak ilgili g\u00fcvenlik s\u00fcr\u00fcm\u00fcne ge\u00e7ebilirsiniz; farkl\u0131 ana s\u00fcr\u00fcme y\u00fckseltmek ise ayr\u0131ca uyumluluk testi gerektirebilir.<\/p>\n        <div class=\"tp-versions\">\n          <div class=\"tp-ver-card\"><small>Node.js 22 serisi<\/small><strong>22.23.4<\/strong><span>LTS<\/span><a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v22.23.4\/\" target=\"_blank\" rel=\"noopener noreferrer\" aria-label=\"Node.js 22.23.4 s\u00fcr\u00fcm notlar\u0131n\u0131 a\u00e7\">S\u00fcr\u00fcm notlar\u0131<\/a><\/div>\n          <div class=\"tp-ver-card\"><small>Node.js 24 serisi<\/small><strong>24.22.1<\/strong><span>LTS<\/span><a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v24.22.1\/\" target=\"_blank\" rel=\"noopener noreferrer\" aria-label=\"Node.js 24.22.1 s\u00fcr\u00fcm notlar\u0131n\u0131 a\u00e7\">S\u00fcr\u00fcm notlar\u0131<\/a><\/div>\n          <div class=\"tp-ver-card\"><small>Node.js 26 serisi<\/small><strong>26.12.1<\/strong><span>Current<\/span><a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v26.12.1\/\" target=\"_blank\" rel=\"noopener noreferrer\" aria-label=\"Node.js 26.12.1 s\u00fcr\u00fcm notlar\u0131n\u0131 a\u00e7\">S\u00fcr\u00fcm notlar\u0131<\/a><\/div>\n        <\/div>\n        <p class=\"tp-note\">Not: Buradaki s\u00fcr\u00fcmler 21 Ekim 2026 g\u00fcvenlik yay\u0131n\u0131ndaki d\u00fczeltme s\u00fcr\u00fcmleridir. Daha yeni bir g\u00fcvenlik d\u00fczeltmesi yay\u0131mlanm\u0131\u015fsa ayn\u0131 ana s\u00fcr\u00fcmdeki en g\u00fcncel desteklenen yamay\u0131 tercih edin.<\/p>\n      <\/section>\n\n      <section id=\"tp-aciklar\" class=\"tp-section\">\n        <div class=\"tp-kicker\">03 \/ G\u00dcVENL\u0130K ANAL\u0130Z\u0130<\/div>\n        <h2>\u00d6ne \u00e7\u0131kan d\u00f6rt y\u00fcksek \u00f6nem seviyeli a\u00e7\u0131k<\/h2>\n        <p>Resm\u00ee duyuru i\u00e7inde dikkat \u00e7eken a\u00e7\u0131klar\u0131n baz\u0131lar\u0131, yaln\u0131zca uygulama mant\u0131\u011f\u0131n\u0131 de\u011fil Node.js&#8217;in do\u011frudan i\u015fledi\u011fi a\u011f ve veri katmanlar\u0131n\u0131 etkiliyor.<\/p>\n        <div class=\"tp-featured-risk\">\n          <div class=\"tp-risk-head\"><span class=\"tp-risk-label\">HIGH \u00b7 \u00d6NE \u00c7IKAN R\u0130SK<\/span><span class=\"tp-cve\">CVE-2026-111497<\/span><\/div>\n          <h3>Brotli decoder: Bellek bozulmas\u0131 ve uzaktan kod \u00e7al\u0131\u015ft\u0131rma riski<\/h3>\n          <p>Bozuk bi\u00e7imlendirilmi\u015f Brotli verilerinin \u00e7\u00f6z\u00fclmesi s\u0131ras\u0131nda s\u0131n\u0131r d\u0131\u015f\u0131 bellek yazma hatas\u0131 olu\u015fabiliyor. Sald\u0131rgan\u0131n uygulamaya \u00e7\u00f6zd\u00fcrebildi\u011fi s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f veriler belirli ko\u015fullarda \u00e7\u00f6kme, bellek i\u00e7eri\u011finin a\u00e7\u0131\u011fa \u00e7\u0131kmas\u0131 veya uzaktan kod \u00e7al\u0131\u015ft\u0131rma riskine yol a\u00e7abiliyor. <strong>Etkilenen seriler: 22.x, 24.x ve 26.x.<\/strong><\/p>\n        <\/div>\n        <div class=\"tp-risk-grid\">\n          <div class=\"tp-risk-card\"><span class=\"tp-cve\">CVE-2026-105482 \u00b7 HIGH<\/span><h3>DNS adres \u00e7\u00f6z\u00fcmlemede NUL karakteri<\/h3><p><code>dns.resolve*()<\/code> ve <code>dns.reverse()<\/code> i\u015flemlerinde alan ad\u0131 kesilmesi, do\u011frulanan ad ile \u00e7\u00f6z\u00fcmlenen hedefin farkl\u0131la\u015fmas\u0131na neden olabiliyor. <strong>22 \/ 24 \/ 26<\/strong><\/p><\/div>\n          <div class=\"tp-risk-card\"><span class=\"tp-cve\">CVE-2026-105483 \u00b7 HIGH<\/span><h3>TLS do\u011frulamas\u0131nda Unicode IP g\u00f6sterimi<\/h3><p>Tam geni\u015flikli rakamlarla yaz\u0131lm\u0131\u015f IP adreslerinde sertifika ana makine ad\u0131 denetimi atlat\u0131labiliyor. <strong>24 \/ 26<\/strong><\/p><\/div>\n          <div class=\"tp-risk-card\"><span class=\"tp-cve\">CVE-2026-106069 \u00b7 HIGH<\/span><h3>Standart d\u0131\u015f\u0131 IPv4 adresleri<\/h3><p>\u00d6nc\u00fc s\u0131f\u0131r i\u00e7eren IPv4 g\u00f6sterimleri, baz\u0131 platformlarda ba\u011flant\u0131 adresi ile sertifika do\u011frulamas\u0131n\u0131n farkl\u0131 hedefleri yorumlamas\u0131na neden olabiliyor. <strong>22 \/ 24 \/ 26<\/strong><\/p><\/div>\n          <div class=\"tp-risk-card\"><span class=\"tp-cve\">GEL\u0130\u015eT\u0130R\u0130C\u0130 NOTU<\/span><h3>Risk, kullan\u0131m senaryosuna ba\u011fl\u0131d\u0131r<\/h3><p>\u00d6rne\u011fin g\u00fcvenilmeyen Brotli girdilerini a\u00e7an servisler ile yaln\u0131zca kontrol edilen i\u00e7 veriyi i\u015fleyen servislerin maruziyeti ayn\u0131 de\u011fildir. Yine de g\u00fcvenlik yamas\u0131n\u0131 uygulamak en do\u011fru ilk ad\u0131md\u0131r.<\/p><\/div>\n        <\/div>\n      <\/section>\n\n      <section id=\"tp-diger\" class=\"tp-section\">\n        <div class=\"tp-kicker\">04 \/ EK D\u00dcZELTMELER<\/div>\n        <h2>Di\u011fer a\u00e7\u0131klar ve ba\u011f\u0131ml\u0131l\u0131k g\u00fcncellemeleri<\/h2>\n        <p>Y\u00fcksek \u00f6nemdeki sorunlar\u0131n yan\u0131 s\u0131ra, orta ve d\u00fc\u015f\u00fck seviyeli ba\u015fka d\u00fczeltmeler de yay\u0131mland\u0131:<\/p>\n        <ul class=\"tp-bullets\">\n          <li><span class=\"tp-list-mark\" aria-hidden=\"true\"><\/span><span><strong>CVE-2026-105481 (Medium):<\/strong> Keep-alive HTTP soketlerinde istek g\u00f6nderilmeden \u00f6nce al\u0131nan yan\u0131t\u0131n sonraki istek i\u00e7in kabul edilebilmesi. <strong>22 \/ 24 \/ 26<\/strong><\/span><\/li>\n          <li><span class=\"tp-list-mark\" aria-hidden=\"true\"><\/span><span><strong>CVE-2026-106072 (Medium):<\/strong> Standart d\u0131\u015f\u0131 IPv4 yaz\u0131mlar\u0131nda DNS SAN \u00fczerinden yanl\u0131\u015f sertifika do\u011frulamas\u0131. <strong>22 \/ 24 \/ 26<\/strong><\/span><\/li>\n          <li><span class=\"tp-list-mark\" aria-hidden=\"true\"><\/span><span><strong>CVE-2026-106074 (Medium):<\/strong> Ba\u015flang\u0131\u00e7 snapshot&#8217;lar\u0131nda <code>crypto.randomUUID()<\/code> ve <code>randomInt()<\/code> \u00f6nbelleklerinin s\u00fcre\u00e7ler aras\u0131nda tekrarlanan de\u011ferler \u00fcretebilmesi. <strong>22 \/ 24 \/ 26<\/strong><\/span><\/li>\n          <li><span class=\"tp-list-mark\" aria-hidden=\"true\"><\/span><span><strong>CVE-2026-106070 (Low):<\/strong> ZIP ba\u015fl\u0131\u011f\u0131 do\u011frulamas\u0131 ba\u015far\u0131s\u0131z oldu\u011funda istenmeyen verinin d\u00f6nebilmesi. <strong>Yaln\u0131zca 26<\/strong><\/span><\/li>\n          <li><span class=\"tp-list-mark\" aria-hidden=\"true\"><\/span><span><strong>CVE-2026-106071 (Low):<\/strong> Permission Model i\u00e7inde wildcard dosya eri\u015fim izinlerinin beklenenden geni\u015f uygulanabilmesi. <strong>Yaln\u0131zca 26<\/strong><\/span><\/li>\n          <li><span class=\"tp-list-mark\" aria-hidden=\"true\"><\/span><span><strong>CVE-2026-106073 (Low):<\/strong> <code>fs.realpathSync()<\/code> \u00fczerinden izin modeli k\u0131s\u0131tlamalar\u0131n\u0131n a\u015f\u0131labilmesi. <strong>22 \/ 24 \/ 26<\/strong><\/span><\/li>\n        <\/ul>\n        <div class=\"tp-soft-banner\"><p><strong>Ba\u011f\u0131ml\u0131l\u0131klar da g\u00fcncellendi:<\/strong> G\u00fcvenlik yay\u0131n\u0131 kapsam\u0131nda <strong>c-ares, CA sertifikalar\u0131 ve Undici<\/strong> \u00fc\u00e7 seride; <strong>OpenSSL<\/strong> 22 ve 24 serilerinde; <strong>SQLite<\/strong> ise 22 serisinde g\u00fcncelleme ald\u0131. Bu nedenle yaln\u0131zca uygulama paketlerini yenilemek, \u00e7al\u0131\u015fma zaman\u0131 g\u00fcvenlik g\u00fcncellemesinin yerini tutmaz.<\/p><\/div>\n      <\/section>\n\n      <section id=\"tp-adimlar\" class=\"tp-section\">\n        <div class=\"tp-kicker\">05 \/ UYGULAMA REHBER\u0130<\/div>\n        <h2>Geli\u015ftiriciler i\u00e7in g\u00fcvenli g\u00fcncelleme ad\u0131mlar\u0131<\/h2>\n        <p>G\u00fcncellemeyi planlarken bilgisayar\u0131n\u0131zdaki s\u00fcr\u00fcm kadar sunucuda, Docker imaj\u0131nda ve CI\/CD ortam\u0131nda \u00e7al\u0131\u015fan Node.js s\u00fcr\u00fcmlerini de kontrol edin.<\/p>\n        <div class=\"tp-steps\">\n          <div class=\"tp-step\"><div class=\"tp-step-num\">01<\/div><div><h3>Aktif Node.js s\u00fcr\u00fcm\u00fcn\u00fc do\u011frulay\u0131n<\/h3><p>\u00d6nce geli\u015ftirme ve \u00fcretim ortamlar\u0131nda \u00e7al\u0131\u015fan s\u00fcr\u00fcmleri belirleyin. Terminalde a\u015fa\u011f\u0131daki komutla aktif \u00e7al\u0131\u015fma zaman\u0131n\u0131 g\u00f6rebilirsiniz.<\/p><\/div><\/div>\n        <\/div>\n        <div class=\"tp-code\"><div class=\"tp-codebar\"><span>TERMINAL \u00b7 VERSION CHECK<\/span><div class=\"tp-window-dots\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><\/div><pre><span class=\"tp-comment\"># Aktif Node.js s\u00fcr\u00fcm\u00fcn\u00fc kontrol et<\/span>\n<span class=\"tp-command\">node --version<\/span>\n\n<span class=\"tp-comment\"># Kullan\u0131lan npm s\u00fcr\u00fcm\u00fcn\u00fc kontrol et<\/span>\n<span class=\"tp-command\">npm --version<\/span><\/pre><\/div>\n        <div class=\"tp-steps\">\n          <div class=\"tp-step\"><div class=\"tp-step-num\">02<\/div><div><h3>Kulland\u0131\u011f\u0131n\u0131z ana s\u00fcr\u00fcme ait yamaya ge\u00e7in<\/h3><p><code>nvm<\/code> kullan\u0131yorsan\u0131z a\u015fa\u011f\u0131daki \u00f6rnekteki gibi, mevcut ana s\u00fcr\u00fcm\u00fcn\u00fcze uygun d\u00fczeltmeyi y\u00fckleyin. \u00dc\u00e7 komutu birlikte \u00e7al\u0131\u015ft\u0131rmak gerekmez; yaln\u0131zca projeniz i\u00e7in gerekli olan\u0131 se\u00e7in.<\/p><\/div><\/div>\n        <\/div>\n        <div class=\"tp-code\"><div class=\"tp-codebar\"><span>TERMINAL \u00b7 NVM \u00d6RNEKLER\u0130<\/span><div class=\"tp-window-dots\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><\/div><pre><span class=\"tp-comment\"># Node.js 22 kullanan projeler<\/span>\n<span class=\"tp-command\">nvm install 22.23.4<\/span>\n\n<span class=\"tp-comment\"># Node.js 24 kullanan projeler<\/span>\n<span class=\"tp-command\">nvm install 24.22.1<\/span>\n\n<span class=\"tp-comment\"># Node.js 26 kullanan projeler<\/span>\n<span class=\"tp-command\">nvm install 26.12.1<\/span>\n\n<span class=\"tp-comment\"># \u00d6rnek: Kurulan 24.x s\u00fcr\u00fcm\u00fcn\u00fc etkinle\u015ftir<\/span>\n<span class=\"tp-command\">nvm use 24.22.1<\/span><\/pre><\/div>\n        <div class=\"tp-steps\">\n          <div class=\"tp-step\"><div class=\"tp-step-num\">03<\/div><div><h3>Ba\u011f\u0131ml\u0131l\u0131k ve uyumluluk testlerini \u00e7al\u0131\u015ft\u0131r\u0131n<\/h3><p>Testleri, uygulaman\u0131n ger\u00e7ekten \u00e7al\u0131\u015faca\u011f\u0131 Node.js s\u00fcr\u00fcm\u00fcnde ger\u00e7ekle\u015ftirin. Birim testleri, entegrasyon testleri, TLS ve d\u0131\u015f servis ba\u011flant\u0131lar\u0131 ile s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f i\u00e7erik ak\u0131\u015flar\u0131n\u0131 do\u011frulay\u0131n.<\/p><\/div><\/div>\n          <div class=\"tp-step\"><div class=\"tp-step-num\">04<\/div><div><h3>\u00dcretim da\u011f\u0131t\u0131mlar\u0131n\u0131 g\u00fcncelleyin<\/h3><p>Docker taban imajlar\u0131, CI\/CD \u00e7al\u0131\u015fma ortamlar\u0131, sunucu paketleri ve s\u00fcre\u00e7 y\u00f6neticileri gibi t\u00fcm da\u011f\u0131t\u0131m noktalar\u0131n\u0131 kontrol edin. Ard\u0131ndan uygulamay\u0131 yeniden da\u011f\u0131t\u0131n veya ilgili servisleri yeniden ba\u015flat\u0131n.<\/p><\/div><\/div>\n          <div class=\"tp-step\"><div class=\"tp-step-num\">05<\/div><div><h3>Ger\u00e7ek \u00e7al\u0131\u015fan s\u00fcr\u00fcm\u00fc tekrar do\u011frulay\u0131n<\/h3><p>G\u00fcncelleme sonras\u0131 yaln\u0131zca yerel terminale de\u011fil, \u00fcretimde \u00e7al\u0131\u015fan s\u00fcrecin s\u00fcr\u00fcm\u00fcne bak\u0131n. Hata kay\u0131tlar\u0131n\u0131 ve servis sa\u011fl\u0131\u011f\u0131n\u0131 takip ederek g\u00fcncellemenin tamamland\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/p><\/div><\/div>\n        <\/div>\n        <div class=\"tp-soft-banner\"><p><strong>\u00d6nemli ayr\u0131m:<\/strong> <code>npm audit<\/code> uygulama ba\u011f\u0131ml\u0131l\u0131klar\u0131ndaki baz\u0131 a\u00e7\u0131klar\u0131 tespit etmeye yard\u0131mc\u0131 olur; ancak Node.js \u00e7al\u0131\u015fma zaman\u0131n\u0131 otomatik olarak yamalamaz. G\u00fcvenlik i\u00e7in hem \u00e7al\u0131\u015fma zaman\u0131 hem de paket ba\u011f\u0131ml\u0131l\u0131klar\u0131 ayr\u0131 ayr\u0131 y\u00f6netilmelidir.<\/p><\/div>\n      <\/section>\n\n      <section id=\"tp-sss\" class=\"tp-section\">\n        <div class=\"tp-kicker\">06 \/ SIK SORULAN SORULAR<\/div>\n        <h2>Node.js g\u00fcncellemesi hakk\u0131nda merak edilenler<\/h2>\n        <div class=\"tp-faq\">\n          <details><summary>Node.js 22, 24 veya 26 kullan\u0131yorum. G\u00fcncelleme zorunlu mu?<\/summary><p>Etkilenen bir s\u00fcr\u00fcmdeyseniz g\u00fcvenlik yamas\u0131n\u0131 uygulaman\u0131z g\u00fc\u00e7l\u00fc bi\u00e7imde \u00f6nerilir. G\u00fcncelleme \u00f6ncesinde uygulaman\u0131z\u0131n ve ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131z\u0131n uyumlulu\u011funu test edin.<\/p><\/details>\n          <details><summary>Yaln\u0131zca npm paketlerini g\u00fcncellemek yeterli mi?<\/summary><p>Hay\u0131r. Bu duyuruda Node.js&#8217;in kendisindeki ve beraberinde da\u011f\u0131t\u0131lan bile\u015fenlerdeki a\u00e7\u0131klar ele al\u0131n\u0131yor. npm ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 g\u00fcncellemek, Node.js \u00e7al\u0131\u015fma zaman\u0131 s\u00fcr\u00fcm\u00fcn\u00fc de\u011fi\u015ftirmez.<\/p><\/details>\n          <details><summary>Eski ve destek d\u0131\u015f\u0131 Node.js s\u00fcr\u00fcmleri kullan\u0131yorsam ne yapmal\u0131y\u0131m?<\/summary><p>Destek d\u0131\u015f\u0131 s\u00fcr\u00fcmler yeni g\u00fcvenlik yamalar\u0131 almaz. Uygulaman\u0131z\u0131 desteklenen bir Node.js s\u00fcr\u00fcm\u00fcne ta\u015f\u0131yacak bir ge\u00e7i\u015f plan\u0131 olu\u015fturun ve resm\u00ee s\u00fcr\u00fcm takvimini esas al\u0131n.<\/p><\/details>\n          <details><summary>G\u00fcncellemeyi yaln\u0131zca geli\u015ftirici bilgisayar\u0131mda yapmak yeterli mi?<\/summary><p>Hay\u0131r. As\u0131l \u00f6nemli olan \u00fcretimde \u00e7al\u0131\u015fan Node.js s\u00fcr\u00fcm\u00fcd\u00fcr. Container, sunucu, y\u00f6netilen platform ve CI\/CD gibi t\u00fcm ortamlarda kullan\u0131lan s\u00fcr\u00fcmleri ayr\u0131 ayr\u0131 kontrol edin.<\/p><\/details>\n        <\/div>\n      <\/section>\n\n      <section id=\"tp-kaynaklar\" class=\"tp-section\">\n        <div class=\"tp-kicker\">07 \/ KAYNAKLAR<\/div>\n        <h2>Resm\u00ee s\u00fcr\u00fcm notlar\u0131 ve g\u00fcvenlik duyurusu<\/h2>\n        <p>Bu yaz\u0131, 21 Ekim 2026 tarihli Node.js Project g\u00fcvenlik yay\u0131n\u0131 ve ilgili resm\u00ee s\u00fcr\u00fcm notlar\u0131 esas al\u0131narak haz\u0131rlanm\u0131\u015ft\u0131r. G\u00fcncelleme yapmadan \u00f6nce en yeni g\u00fcvenlik duyurular\u0131n\u0131 da kontrol edin.<\/p>\n        <ul class=\"tp-source-list\">\n          <li>01 \u2014 <a href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" target=\"_blank\" rel=\"noopener noreferrer\">October 2026 Security Releases \u2014 Node.js Project<\/a><\/li>\n          <li>02 \u2014 <a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v22.23.4\/\" target=\"_blank\" rel=\"noopener noreferrer\">Node.js v22.23.4 Release Notes<\/a><\/li>\n          <li>03 \u2014 <a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v24.22.1\/\" target=\"_blank\" rel=\"noopener noreferrer\">Node.js v24.22.1 Release Notes<\/a><\/li>\n          <li>04 \u2014 <a href=\"https:\/\/nodejs.org\/en\/blog\/release\/v26.12.1\/\" target=\"_blank\" rel=\"noopener noreferrer\">Node.js v26.12.1 Release Notes<\/a><\/li>\n          <li>05 \u2014 <a href=\"https:\/\/nodejs.org\/en\/about\/previous-releases\" target=\"_blank\" rel=\"noopener noreferrer\">Node.js s\u00fcr\u00fcm ve destek takvimi<\/a><\/li>\n        <\/ul>\n      <\/section>\n    <\/div>\n  <\/div>\n  <footer class=\"tp-bottom\">\n    <div class=\"tp-shell\"><div class=\"tp-bottom-card\"><div><small>TECHPARK \/ DEVELOPMENT<\/small><h2>G\u00fcncel kalmak, g\u00fcvenli geli\u015ftirmenin bir par\u00e7as\u0131d\u0131r.<\/h2><p>Node.js g\u00fcncellemelerini izleyin, uyumlulu\u011fu test edin ve \u00fcretimde kulland\u0131\u011f\u0131n\u0131z s\u00fcr\u00fcm\u00fc d\u00fczenli olarak do\u011frulay\u0131n.<\/p><\/div><a class=\"tp-btn\" href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/october-2026-security-releases\" target=\"_blank\" rel=\"noopener noreferrer\">Resm\u00ee duyuruyu incele<\/a><\/div><\/div>\n  <\/footer>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>TECHPARK \/ DEVELOPMENT \/ SECURITY Node.js 22, 24 ve 26 i\u00e7in g\u00fcvenlik g\u00fcncellemeleri yay\u0131mland\u0131 21 Ekim 2026 tarihli g\u00fcvenlik s\u00fcr\u00fcmleri, Node.js ekosistemindeki \u00f6nemli a\u00e7\u0131klara \u00e7\u00f6z\u00fcm getiriyor. Hangi s\u00fcr\u00fcme ge\u00e7meniz gerekti\u011fini, \u00f6ne \u00e7\u0131kan riskleri ve g\u00fcncelleme s\u00fcrecini birlikte inceleyelim. 24 Ekim 2026DevelopmentYakla\u015f\u0131k 7 dakika okuma N. 21 OCT 2026 Security release overview Node.js 22.xLong-Term Support v22.23.4 FIXED Node.js 24.xLong-Term Support v24.22.1 FIXED Node.js 26.xCurrent v26.12.1 FIXED Security bulletin \/ October 2026HIGH \u00b7 En y\u00fcksek \u00f6nem \u0130\u00c7\u0130NDEK\u0130LER G\u00fcncelleme neden \u00f6nemli? G\u00fcncel s\u00fcr\u00fcmler \u00d6ne \u00e7\u0131kan g\u00fcvenlik a\u00e7\u0131klar\u0131 Di\u011fer d\u00fczeltmeler Nas\u0131l g\u00fcncellenir? S\u0131k sorulan sorular Resm\u00ee kaynaklar Node.js duyurusu K\u0131sa \u00f6zet: Node.js ekibi, 22.x, 24.x ve 26.x s\u00fcr\u00fcm serileri i\u00e7in toplam 10 CVE i\u00e7eren bir g\u00fcvenlik duyurusu yay\u0131mlad\u0131. Bunlar\u0131n d\u00f6rd\u00fc y\u00fcksek (High), \u00fc\u00e7\u00fc orta (Medium), \u00fc\u00e7\u00fc d\u00fc\u015f\u00fck (Low) \u00f6nem seviyesinde. Her a\u00e7\u0131kl\u0131k her s\u00fcr\u00fcm serisini etkilemiyor; bu nedenle do\u011fru d\u00fczeltme s\u00fcr\u00fcm\u00fcn\u00fc kullanmak kritik. 01 \/ GENEL BAKI\u015e Bu g\u00fcvenlik g\u00fcncellemesi neden \u00f6nemli? Node.js; web uygulamalar\u0131n\u0131n arka u\u00e7 servislerinde, API altyap\u0131lar\u0131nda, otomasyon s\u00fcre\u00e7lerinde ve geli\u015ftirme ara\u00e7lar\u0131nda yayg\u0131n olarak kullan\u0131l\u0131yor. \u00c7al\u0131\u015fma zaman\u0131ndaki bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131, uygulama kodu de\u011fi\u015fmemi\u015f olsa bile sistemlerin risk alt\u0131nda kalmas\u0131na neden olabilir. 21 Ekim 2026 g\u00fcncellemesi; DNS \u00e7\u00f6z\u00fcmleme, TLS sertifika kontrol\u00fc, Brotli s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f veri i\u015fleme, HTTP ba\u011flant\u0131 y\u00f6netimi ve izin modeli gibi temel alanlara odaklan\u0131yor. En y\u00fcksek \u00f6nem seviyesi High olarak duyuruldu. Bu, t\u00fcm sistemlerin mutlaka s\u00f6m\u00fcr\u00fcld\u00fc\u011f\u00fc anlam\u0131na gelmez; ancak etkilenen ortamlarda g\u00fcncellemenin geciktirilmemesi gerekti\u011fini g\u00f6sterir. 3\u00d7G\u00fcncellenen ana s\u00fcr\u00fcm serisi 10Duyuruda ele al\u0131nan CVE 4Y\u00fcksek \u00f6nem seviyeli a\u00e7\u0131k 02 \/ S\u00dcR\u00dcM REHBER\u0130 Hangi Node.js s\u00fcr\u00fcm\u00fcne g\u00fcncellemelisiniz? Node.js Project taraf\u0131ndan yay\u0131mlanan d\u00fczeltme s\u00fcr\u00fcmleri a\u015fa\u011f\u0131daki gibidir. Mevcut ana s\u00fcr\u00fcm\u00fcn\u00fcz\u00fc koruyarak ilgili g\u00fcvenlik s\u00fcr\u00fcm\u00fcne ge\u00e7ebilirsiniz; farkl\u0131 ana s\u00fcr\u00fcme y\u00fckseltmek ise ayr\u0131ca uyumluluk testi gerektirebilir. Node.js 22 serisi22.23.4LTSS\u00fcr\u00fcm notlar\u0131 Node.js 24 serisi24.22.1LTSS\u00fcr\u00fcm notlar\u0131 Node.js 26 serisi26.12.1CurrentS\u00fcr\u00fcm notlar\u0131 Not: Buradaki s\u00fcr\u00fcmler 21 Ekim 2026 g\u00fcvenlik yay\u0131n\u0131ndaki d\u00fczeltme s\u00fcr\u00fcmleridir. Daha yeni bir g\u00fcvenlik d\u00fczeltmesi yay\u0131mlanm\u0131\u015fsa ayn\u0131 ana s\u00fcr\u00fcmdeki en g\u00fcncel desteklenen yamay\u0131 tercih edin. 03 \/ G\u00dcVENL\u0130K ANAL\u0130Z\u0130 \u00d6ne \u00e7\u0131kan d\u00f6rt y\u00fcksek \u00f6nem seviyeli a\u00e7\u0131k Resm\u00ee duyuru i\u00e7inde dikkat \u00e7eken a\u00e7\u0131klar\u0131n baz\u0131lar\u0131, yaln\u0131zca uygulama mant\u0131\u011f\u0131n\u0131 de\u011fil Node.js&#8217;in do\u011frudan i\u015fledi\u011fi a\u011f ve veri katmanlar\u0131n\u0131 etkiliyor. HIGH \u00b7 \u00d6NE \u00c7IKAN R\u0130SKCVE-2026-111497 Brotli decoder: Bellek bozulmas\u0131 ve uzaktan kod \u00e7al\u0131\u015ft\u0131rma riski Bozuk bi\u00e7imlendirilmi\u015f Brotli verilerinin \u00e7\u00f6z\u00fclmesi s\u0131ras\u0131nda s\u0131n\u0131r d\u0131\u015f\u0131 bellek yazma hatas\u0131 olu\u015fabiliyor. Sald\u0131rgan\u0131n uygulamaya \u00e7\u00f6zd\u00fcrebildi\u011fi s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f veriler belirli ko\u015fullarda \u00e7\u00f6kme, bellek i\u00e7eri\u011finin a\u00e7\u0131\u011fa \u00e7\u0131kmas\u0131 veya uzaktan kod \u00e7al\u0131\u015ft\u0131rma riskine yol a\u00e7abiliyor. Etkilenen seriler: 22.x, 24.x ve 26.x. CVE-2026-105482 \u00b7 HIGH DNS adres \u00e7\u00f6z\u00fcmlemede NUL karakteri dns.resolve*() ve dns.reverse() i\u015flemlerinde alan ad\u0131 kesilmesi, do\u011frulanan ad ile \u00e7\u00f6z\u00fcmlenen hedefin farkl\u0131la\u015fmas\u0131na neden olabiliyor. 22 \/ 24 \/ 26 CVE-2026-105483 \u00b7 HIGH TLS do\u011frulamas\u0131nda Unicode IP g\u00f6sterimi Tam geni\u015flikli rakamlarla yaz\u0131lm\u0131\u015f IP adreslerinde sertifika ana makine ad\u0131 denetimi atlat\u0131labiliyor. 24 \/ 26 CVE-2026-106069 \u00b7 HIGH Standart d\u0131\u015f\u0131 IPv4 adresleri \u00d6nc\u00fc s\u0131f\u0131r i\u00e7eren IPv4 g\u00f6sterimleri, baz\u0131 platformlarda ba\u011flant\u0131 adresi ile sertifika do\u011frulamas\u0131n\u0131n farkl\u0131 hedefleri yorumlamas\u0131na neden olabiliyor. 22 \/ 24 \/ 26 GEL\u0130\u015eT\u0130R\u0130C\u0130 NOTU Risk, kullan\u0131m senaryosuna ba\u011fl\u0131d\u0131r \u00d6rne\u011fin g\u00fcvenilmeyen Brotli girdilerini a\u00e7an servisler ile yaln\u0131zca kontrol edilen i\u00e7 veriyi i\u015fleyen servislerin maruziyeti ayn\u0131 de\u011fildir. Yine de g\u00fcvenlik yamas\u0131n\u0131 uygulamak en do\u011fru ilk ad\u0131md\u0131r. 04 \/ EK D\u00dcZELTMELER Di\u011fer a\u00e7\u0131klar ve ba\u011f\u0131ml\u0131l\u0131k g\u00fcncellemeleri Y\u00fcksek \u00f6nemdeki sorunlar\u0131n yan\u0131 s\u0131ra, orta ve d\u00fc\u015f\u00fck seviyeli ba\u015fka d\u00fczeltmeler de yay\u0131mland\u0131: CVE-2026-105481 (Medium): Keep-alive HTTP soketlerinde istek g\u00f6nderilmeden \u00f6nce al\u0131nan yan\u0131t\u0131n sonraki istek i\u00e7in kabul edilebilmesi. 22 \/ 24 \/ 26 CVE-2026-106072 (Medium): Standart d\u0131\u015f\u0131 IPv4 yaz\u0131mlar\u0131nda DNS SAN \u00fczerinden yanl\u0131\u015f sertifika do\u011frulamas\u0131. 22 \/ 24 \/ 26 CVE-2026-106074 (Medium): Ba\u015flang\u0131\u00e7 snapshot&#8217;lar\u0131nda crypto.randomUUID() ve randomInt() \u00f6nbelleklerinin s\u00fcre\u00e7ler aras\u0131nda tekrarlanan de\u011ferler \u00fcretebilmesi. 22 \/ 24 \/ 26 CVE-2026-106070 (Low): ZIP ba\u015fl\u0131\u011f\u0131 do\u011frulamas\u0131 ba\u015far\u0131s\u0131z oldu\u011funda istenmeyen verinin d\u00f6nebilmesi. Yaln\u0131zca 26 CVE-2026-106071 (Low): Permission Model i\u00e7inde wildcard dosya eri\u015fim izinlerinin beklenenden geni\u015f uygulanabilmesi. Yaln\u0131zca 26 CVE-2026-106073 (Low): fs.realpathSync() \u00fczerinden izin modeli k\u0131s\u0131tlamalar\u0131n\u0131n a\u015f\u0131labilmesi. 22 \/ 24 \/ 26 Ba\u011f\u0131ml\u0131l\u0131klar da g\u00fcncellendi: G\u00fcvenlik yay\u0131n\u0131 kapsam\u0131nda c-ares, CA sertifikalar\u0131 ve Undici \u00fc\u00e7 seride; OpenSSL 22 ve 24 serilerinde; SQLite ise 22 serisinde g\u00fcncelleme ald\u0131. Bu nedenle yaln\u0131zca uygulama paketlerini yenilemek, \u00e7al\u0131\u015fma zaman\u0131 g\u00fcvenlik g\u00fcncellemesinin yerini tutmaz. 05 \/ UYGULAMA REHBER\u0130 Geli\u015ftiriciler i\u00e7in g\u00fcvenli g\u00fcncelleme ad\u0131mlar\u0131 G\u00fcncellemeyi planlarken bilgisayar\u0131n\u0131zdaki s\u00fcr\u00fcm kadar sunucuda, Docker imaj\u0131nda ve CI\/CD ortam\u0131nda \u00e7al\u0131\u015fan Node.js s\u00fcr\u00fcmlerini de kontrol edin. 01 Aktif Node.js s\u00fcr\u00fcm\u00fcn\u00fc do\u011frulay\u0131n \u00d6nce geli\u015ftirme ve \u00fcretim ortamlar\u0131nda \u00e7al\u0131\u015fan s\u00fcr\u00fcmleri belirleyin. Terminalde a\u015fa\u011f\u0131daki komutla aktif \u00e7al\u0131\u015fma zaman\u0131n\u0131 g\u00f6rebilirsiniz. TERMINAL \u00b7 VERSION CHECK # Aktif Node.js s\u00fcr\u00fcm\u00fcn\u00fc kontrol et node &#8211;version # Kullan\u0131lan npm s\u00fcr\u00fcm\u00fcn\u00fc kontrol et npm &#8211;version 02 Kulland\u0131\u011f\u0131n\u0131z ana s\u00fcr\u00fcme ait yamaya ge\u00e7in nvm kullan\u0131yorsan\u0131z a\u015fa\u011f\u0131daki \u00f6rnekteki gibi, mevcut ana s\u00fcr\u00fcm\u00fcn\u00fcze uygun d\u00fczeltmeyi y\u00fckleyin. \u00dc\u00e7 komutu birlikte \u00e7al\u0131\u015ft\u0131rmak gerekmez; yaln\u0131zca projeniz i\u00e7in gerekli olan\u0131 se\u00e7in. TERMINAL \u00b7 NVM \u00d6RNEKLER\u0130 # Node.js 22 kullanan projeler nvm install 22.23.4 # Node.js 24 kullanan projeler nvm install 24.22.1 # Node.js 26 kullanan projeler nvm install 26.12.1 # \u00d6rnek: Kurulan 24.x s\u00fcr\u00fcm\u00fcn\u00fc etkinle\u015ftir nvm use 24.22.1 03 Ba\u011f\u0131ml\u0131l\u0131k ve uyumluluk testlerini \u00e7al\u0131\u015ft\u0131r\u0131n Testleri, uygulaman\u0131n ger\u00e7ekten \u00e7al\u0131\u015faca\u011f\u0131 Node.js s\u00fcr\u00fcm\u00fcnde ger\u00e7ekle\u015ftirin. Birim testleri, entegrasyon testleri, TLS ve d\u0131\u015f servis ba\u011flant\u0131lar\u0131 ile s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f i\u00e7erik ak\u0131\u015flar\u0131n\u0131 do\u011frulay\u0131n. 04 \u00dcretim da\u011f\u0131t\u0131mlar\u0131n\u0131 g\u00fcncelleyin Docker taban imajlar\u0131, CI\/CD \u00e7al\u0131\u015fma ortamlar\u0131, sunucu paketleri ve s\u00fcre\u00e7 y\u00f6neticileri gibi t\u00fcm da\u011f\u0131t\u0131m noktalar\u0131n\u0131 kontrol edin. Ard\u0131ndan uygulamay\u0131 yeniden da\u011f\u0131t\u0131n veya ilgili servisleri yeniden ba\u015flat\u0131n. 05 Ger\u00e7ek \u00e7al\u0131\u015fan s\u00fcr\u00fcm\u00fc tekrar do\u011frulay\u0131n G\u00fcncelleme sonras\u0131 yaln\u0131zca yerel terminale de\u011fil, \u00fcretimde \u00e7al\u0131\u015fan s\u00fcrecin s\u00fcr\u00fcm\u00fcne bak\u0131n. Hata kay\u0131tlar\u0131n\u0131 ve servis sa\u011fl\u0131\u011f\u0131n\u0131 takip ederek g\u00fcncellemenin tamamland\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n. \u00d6nemli ayr\u0131m: npm audit uygulama ba\u011f\u0131ml\u0131l\u0131klar\u0131ndaki baz\u0131 a\u00e7\u0131klar\u0131 tespit etmeye yard\u0131mc\u0131 olur; ancak Node.js \u00e7al\u0131\u015fma zaman\u0131n\u0131 otomatik olarak yamalamaz. G\u00fcvenlik i\u00e7in hem \u00e7al\u0131\u015fma zaman\u0131 hem de paket ba\u011f\u0131ml\u0131l\u0131klar\u0131 ayr\u0131 ayr\u0131 y\u00f6netilmelidir. 06 \/ SIK SORULAN SORULAR Node.js g\u00fcncellemesi hakk\u0131nda merak edilenler Node.js 22, 24 veya 26 kullan\u0131yorum. G\u00fcncelleme zorunlu mu? Etkilenen bir s\u00fcr\u00fcmdeyseniz g\u00fcvenlik yamas\u0131n\u0131 uygulaman\u0131z g\u00fc\u00e7l\u00fc bi\u00e7imde \u00f6nerilir. G\u00fcncelleme \u00f6ncesinde uygulaman\u0131z\u0131n ve ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131z\u0131n uyumlulu\u011funu test edin. Yaln\u0131zca npm paketlerini g\u00fcncellemek yeterli mi? Hay\u0131r. Bu duyuruda Node.js&#8217;in kendisindeki ve beraberinde da\u011f\u0131t\u0131lan bile\u015fenlerdeki a\u00e7\u0131klar ele al\u0131n\u0131yor. npm ba\u011f\u0131ml\u0131l\u0131klar\u0131n\u0131 g\u00fcncellemek, Node.js \u00e7al\u0131\u015fma zaman\u0131 s\u00fcr\u00fcm\u00fcn\u00fc de\u011fi\u015ftirmez. Eski ve destek d\u0131\u015f\u0131 Node.js s\u00fcr\u00fcmleri kullan\u0131yorsam ne yapmal\u0131y\u0131m? Destek d\u0131\u015f\u0131 s\u00fcr\u00fcmler yeni g\u00fcvenlik yamalar\u0131 almaz. Uygulaman\u0131z\u0131 desteklenen bir Node.js s\u00fcr\u00fcm\u00fcne ta\u015f\u0131yacak bir ge\u00e7i\u015f plan\u0131 olu\u015fturun ve resm\u00ee s\u00fcr\u00fcm takvimini esas al\u0131n. G\u00fcncellemeyi yaln\u0131zca geli\u015ftirici bilgisayar\u0131mda yapmak yeterli mi?<\/p>\n","protected":false},"author":2,"featured_media":806,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11,21],"tags":[],"class_list":["post-799","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-development","category-programming-languages"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/techparkcyprus.com\/wp-content\/uploads\/2026\/10\/Node.js-Guvenlik-Guncellemeleri-1.png","_links":{"self":[{"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/posts\/799","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/comments?post=799"}],"version-history":[{"count":3,"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/posts\/799\/revisions"}],"predecessor-version":[{"id":805,"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/posts\/799\/revisions\/805"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/media\/806"}],"wp:attachment":[{"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/media?parent=799"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/categories?post=799"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techparkcyprus.com\/index.php\/wp-json\/wp\/v2\/tags?post=799"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}