What Node.js released and why it matters
The advisory covers ten runtime vulnerabilities, four rated high severity. They include issues in TLS certificate validation, keep-alive response processing, DNS resolution, and the Brotli decoder. The project also updated components bundled with Node.js, including c-ares, CA certificates, and Undici. Not every application uses every affected feature, so compare the advisory with your actual configuration.
The key fix is a new Node.js runtime release. Installing a newer npm package does not update the Node process running your API, worker, build tool, or server.
The advisory also lists medium- and low-severity issues involving startup snapshots, ZipFile, and the Permission Model. Applicability depends on how those features are used. You do not need to reproduce an exploit in production to decide whether to install the fixed release.
| Advisory | Severity | Affected lines | Area described by Node.js |
|---|---|---|---|
| CVE-2026-105482 | High | 22.x, 24.x, 26.x | NUL-containing dns.resolve names |
| CVE-2026-105483 | High | 24.x, 26.x | TLS validation with fullwidth digits |
| CVE-2026-106069 | High | 22.x, 24.x, 26.x | TLS hostname validation |
| CVE-2026-111497 | High | 22.x, 24.x, 26.x | Brotli decoder |
| CVE-2026-105481 | Medium | 22.x, 24.x, 26.x | Responses on keep-alive sockets |
| CVE-2026-106072 | Medium | 22.x, 24.x, 26.x | Certificate validation for non-canonical IPv4 |
| CVE-2026-106074 | Medium | 22.x, 24.x, 26.x | Entropy cache in snapshots and SEAs |
| CVE-2026-106070 | Low | 26.x | ZIP header validation |
| CVE-2026-106071 | Low | 26.x | Permission Model wildcard lookup |
| CVE-2026-106073 | Low | 22.x, 24.x, 26.x | Permission Model and fs.realpathSync |
Fixed versions
The fixed upstream releases are Node.js 22.23.4, 24.22.1, and 26.12.1. Node.js says end-of-life versions should also be considered affected when a security release is issued. If you run an older line, check its support status and plan a move to a maintained release.
Container images, Linux distributions, and managed services may package the runtime differently. Check the maintainer’s advisory and verify the version active inside the process serving traffic.
| Release line | Fixed release |
|---|---|
| Node.js 22.x | 22.23.4 |
| Node.js 24.x | 24.22.1 |
| Node.js 26.x | 26.12.1 |
Find every place Node.js runs
Teams often know the version on a laptop or CI runner but not the one serving requests. Inventory web apps, APIs, workers, scheduled jobs, internal tools, Docker images, CI environments, and managed functions. Check base images and runtime pins in the repository too.
Record the service, environment, version, package or image source, owner, operational dependencies, and rollback procedure. Verify from the actual container or runtime, not a separate terminal. Avoid public diagnostics that expose system details.
Update while keeping the runtime in view
Use the fixed package or image recommended by its maintainer. If Node.js is inside a container, update the base image and build a new image; updating the host does not change the runtime inside an existing container. Check workers and secondary processes as well, since they may use a different image or configuration.
Update a representative environment first, confirm the active process version, and follow the provider’s restart or instance replacement steps. For a managed platform, ask which version was applied and when processes were recycled. Keep a rollback path the team has verified.
Plan the regression
Regression testing looks for unintended product behavior after a runtime update. By itself, it does not prove the vulnerability is fixed, that no other vulnerabilities remain, or that every server was updated. Verify runtime versions, inventory, and dependency findings separately.
Start from how each service uses Node.js. If it makes HTTPS requests, check normal connections to internal and external services, certificate validation, timeouts, and retries. If it handles compressed content, exercise ordinary test flows with test data. For keep-alive APIs, check consecutive valid requests and normal error handling. There is no need to send malicious input; test the product’s legitimate contracts and flows.
Include application startup, authentication, permissions, core business actions, persistence, queues, scheduled jobs, and health signals. Select tests based on actual feature use. Record build, environment, runtime version, synthetic data, expected and observed results, and evidence with secrets removed.
Test cases to adapt
These examples are a starting point, not a universal suite. Adjust them to the routes, integrations, and conditions in your product. Run them in an authorized environment with test accounts and data.
| Area | What to test | What to record |
|---|---|---|
| Startup and health | Startup, readiness, and a basic service response. | Process version, build, environment, and sanitized output. |
| HTTPS and certificates | Normal dependency connections; success, failure, and timeout. | Test destination, TLS result, status, and logs without credentials. |
| API and keep-alive | Consecutive valid requests and ordinary error handling. | Synthetic request ID, status, latency, and expected response. |
| Compressed content | Legitimate flows that read or serve compressed content. | Content type, test size, and result. |
| Authentication and permissions | Sign-in/out and allowed and denied access. | Test role and result; never cookies or tokens. |
| Workers and queues | Normal processing, retry, and task recovery. | Synthetic ID, timings, final state, and redacted logs. |
| Persistence | Create, retrieve, and update test data. | Synthetic IDs and before/after checks. |
When to close the review
Agree on release-blocking failures before the update. An unconfirmed runtime version, unexplained new errors, broken authentication or permissions, data loss, stuck queues, or a failed critical integration should pause rollout until the impact is understood.
At close, distinguish passed, failed, blocked, and not applicable. Assign owners to open risks. A blocked case is not a pass, and a green regression only covers the flows that actually ran.
Official Node.js sources
- Node.js: October 21, 2026 security release
- Official release schedule
- Node.js security policy
- Official Node.js downloads
QA planning information. It does not replace the security advisory, provider instructions, or a security assessment. Reviewed October 22, 2026.