Node.js October 2026 Security Release: Brotli RCE and TLS Fixes

Node.js ships security releases in batches, and this one is bigger than usual. Ten CVEs were fixed at once across all three supported lines, together with updates to bundled libraries such as OpenSSL, c-ares and Undici. If you run an API, a Next.js site, a bot or a background worker on Node.js, this update belongs in the current week’s maintenance.

Which Node.js versions are fixed?

The October 2026 security release fixes all ten vulnerabilities in these versions:

A later version in the same line also contains the fixes. Some of the low-severity bugs exist only in Node.js 26, but the high-severity ones affect all three lines.

What does the Brotli bug (CVE-2026-111497) do?

CVE-2026-111497 is an out-of-bounds write in the Brotli decompression code that Node.js bundles. Malformed input makes the decoder keep appending data to an 8-byte buffer instead of stopping. The result can be a crash, a memory leak to the attacker or, in the worst case, code execution inside the Node.js process.

The question to ask is whether your app ever decompresses Brotli data that comes from outside. Common places where it does:

• HTTP servers that accept request bodies sent with Content-Encoding: br.
• Code that calls zlib.brotliDecompress() or createBrotliDecompress() on uploaded files.
• HTTP clients that download from third-party servers and decode br responses automatically.
• Proxies, scrapers and webhooks that pass compressed data along.

If any of these apply, upgrade first and look at the other bugs later.

What are the DNS and TLS bugs?

The other three high-severity fixes are about Node.js being tricked about where it is connecting. They matter most for services that check hostnames against an allowlist or connect to other servers by IP address.

• CVE-2026-105482 (DNS): dns.resolve*() and dns.reverse() silently cut a hostname at a NUL byte. A name like attacker.example\0.trusted.example is resolved as attacker.example, which can slip past checks that only look at the end of the string. It completes an earlier fix that did not cover every case.
• CVE-2026-105483 (TLS): tls.checkServerIdentity() did not recognise IP addresses written with full-width digits, so a certificate issued for a DNS name could be accepted for an IP. This affects Node.js 26 and 24.
• CVE-2026-106069 (TLS): an IPv4 address with a leading zero, such as 0127.0.0.1, was read as octal during the certificate check but as decimal by the system resolver on some platforms. Node.js could validate the certificate against one IP and connect to another.

A related medium bug (CVE-2026-106072) let non-standard IPv4 spellings such as 0x7f.0.0.1 or 127.1 match DNS names in a certificate.

What else is in the release?

• CVE-2026-105481 (medium): an idle keep-alive socket could accept a response that arrived before the request was sent. That opens the door to response mix-ups on reused HTTP connections.
• CVE-2026-106074 (medium): the random-number caches behind crypto.randomUUID(), randomUUIDv7() and randomInt() were saved into startup snapshots and single executable apps (SEA). Every process started from the same file produced the same “random” values.
• Low severity: a zlib.ZipFile header validation issue and an over-broad wildcard match in the Permission Model (both Node.js 26 only), plus missing permission checks in fs.realpathSync() under --permission.
• Bundled libraries: updated c-ares, Undici, OpenSSL (24 and 22), SQLite (22) and the CA certificate list, which drops a compromised intermediate certificate.

How do I upgrade Node.js on a Linux server?

Start by checking the version that is actually running. The node in your shell is not always the one your service uses:

node -v
which -a node
systemctl cat myapp.service | grep -i ExecStart   # shows the binary a systemd service runs
pm2 list                                         # if you use PM2

With a version manager

nvm install 22.23.4      # or 24.22.1 / 26.12.1, or newer
nvm alias default 22.23.4
node -v

Services started by systemd or PM2 often point at a full path inside the version manager folder. Update that path, or the service keeps starting the old binary.

With the distribution or vendor package

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade nodejs

# AlmaLinux / Rocky Linux
sudo dnf upgrade nodejs

Distribution repositories sometimes carry an older major version with backported fixes. Check the package changelog for the CVE numbers if the version string does not match the table above.

In Docker

# Dockerfile
FROM node:22.23.4-alpine    # or a newer tag in your line

Rebuild without cache, push the image and redeploy. Old containers keep running the vulnerable binary until they are replaced.

Restart and verify

sudo systemctl restart myapp
pm2 reload all
node -p "process.version"

If you build startup snapshots or single executable apps, rebuild them with the new version too. The fix for the repeated random values only applies to newly built files.

Still on Node.js 20 or 18?

Node.js 20 reached end of life in April 2026, and 18 a year before that. Neither received these fixes, and neither will get future ones. Moving to Node.js 22 or 24 is usually painless for Express, Fastify and Next.js apps. Run the test suite, watch for deprecation warnings in the logs, and check native modules, which need a rebuild after a major version change (npm rebuild).

A short checklist for this release

1. List every server and container that runs Node.js.
2. Upgrade to 26.12.1, 24.22.1, 22.23.4 or newer.
3. Restart services and confirm the running version.
4. Rebuild Docker images, snapshots and single executable apps.
5. Plan the move off Node.js 20 or older.

Running Node.js apps on a server you control makes this kind of update quick. Our KVM VPS plans give you root access in dozens of countries. For the general hardening steps that go with every update, read the Linux VPS security checklist.