---
title: Node.js 22.23.4, 24.22.1 and 26.12.1 fix four high-severity bugs, including a Brotli decoder out-of-bounds write and TLS hostname-check bypasses | ctxsec
url: https://ctxsec.com/items/nodejs-oct-21-2026-security-releases
description: ""
status: "confirmed (Node.js security release notes)"
published: 2026-10-21
---

> 

[← Cybersecurity News](/news) · [markdown](/items/nodejs-oct-21-2026-security-releases.md)

confirmed (Node.js security release notes)

2026-10-21

### Node.js 22.23.4, 24.22.1 and 26.12.1 fix four high-severity bugs, including a Brotli decoder out-of-bounds write and TLS hostname-check bypasses

The Node.js project shipped [security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) on Oct 21 for all supported lines. High-severity fixes: a Brotli decoder out-of-bounds write that Node.js says permits remote code execution (CVE-2026-111497), `dns.resolve` truncating names at a NUL byte (CVE-2026-105482), and two TLS certificate hostname-validation bypasses involving IP addresses written in fullwidth digits or hosts that loosely resolve to an IP (CVE-2026-105483, CVE-2026-106069). Medium fixes cover keep-alive response confusion, DNS SANs authenticating non-canonical IPv4 endpoints, and `crypto.randomUUID()`/`randomInt()` entropy caches baked into startup snapshots and single-executable apps so every process repeats the same values. The releases also update c-ares, OpenSSL (22.x, 24.x), SQLite (22.x) and Undici, and distrust the compromised eMudhra intermediates.

**Do now:** move to 22.23.4, 24.22.1 or 26.12.1, rebuild container images and SEAs, and regenerate any startup snapshots. End-of-life lines are affected and won't be fixed.

Sources: [Node.js: Oct 21, 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) · [Node.js 22.23.4 release notes](https://nodejs.org/en/blog/release/v22.23.4) · [Node.js v26.12.1 on GitHub](https://github.com/nodejs/node/releases)