The Node.js project shipped security releases on Oct 21 for all supported lines. High-severity fixes: a Brotli decoder out-of-bounds write that Node.js says permits remote code execution (CVE-2026-111497), dns.resolve truncating names at a NUL byte (CVE-2026-105482), and two TLS certificate hostname-validation bypasses involving IP addresses written in fullwidth digits or hosts that loosely resolve to an IP (CVE-2026-105483, CVE-2026-106069). Medium fixes cover keep-alive response confusion, DNS SANs authenticating non-canonical IPv4 endpoints, and crypto.randomUUID()/randomInt() entropy caches baked into startup snapshots and single-executable apps so every process repeats the same values. The releases also update c-ares, OpenSSL (22.x, 24.x), SQLite (22.x) and Undici, and distrust the compromised eMudhra intermediates.

Do now: move to 22.23.4, 24.22.1 or 26.12.1, rebuild container images and SEAs, and regenerate any startup snapshots. End-of-life lines are affected and won't be fixed.