Node.js shipped a coordinated security release on October 21, 2026, patching ten vulnerabilities across all three supported lines at once, v26.12.1, v24.22.1, and v22.23.4. Four of those are rated High, headlined by a Brotli decompression flaw (CVE-2026-111497) that enables remote code execution and is easy to trigger since fetch() and Express 5 auto-decompress Brotli responses. The release also carries a second meaning, landing the day Node abandons its two-majors-a-year model in favor of one annual, year-numbered release starting with Node 27. With Node 20 and Node 25 already end-of-life and no fixes coming, teams are urged to upgrade to 22.23.4, 24.22.1, or 26.12.1 and rebuild any container or snapshot that embeds the runtime.

Node.js ships coordinated security fixes across three release lines in its last release under the old versioning model

Ten vulnerabilities get patched at once, and the timing makes this one historic.

Node.js deployed security updates across all three active release lines on Wednesday, October 21. As of now, every supported version of the runtime was fixed in a single coordinated push: v26.12.1 (Lithium), v24.22.1 (Krypton), and v22.23.4 (Jod). The ten vulnerabilities span High to Low, with four rated High. The most alarming is a Brotli decompression bug that enables remote code execution.

This lands the same day Node flips to a brand-new release model. So the update doubles as a bookend for an entire era of the project.

The vulnerabilities

The headline is CVE-2026-111497. Node bundles Google's Brotli compression library, and the decoder mishandled malformed streams with an out-of-bounds write. Fix the bookkeeping and you've got a path to running arbitrary code.

Why this one bites harder than the rating suggests is reachability. Node's built-in fetch() auto-decompresses Content-Encoding: br responses, and Express 5's body parser does the same for inbound requests. An app can trip this without ever calling Brotli directly. Third-party analysis points to Express 5 servers, Next.js image optimization, and anything scraping or previewing untrusted URLs as exposed paths. To say the least, that's a broad attack surface.

For what it's worth, this isn't the only time a decompression library has turned into a broadly reachable hole. Bun bundles a Brotli decoder too, but this particular flaw is in Node's own copy.

The other three High issues sit in TLS and DNS. Two are certificate-hostname bypasses (CVE-2026-106069 and CVE-2026-105483) that pass verification when the target looks like an IP address. The fourth, CVE-2026-105482, is a DNS name-truncation flaw where dns.resolve quietly chops a name at a NUL byte.

There's a follow-on TLS bypass too, using Unicode "fullwidth" digits for IPv4 addresses (CVE-2026-105483). Here the advisory and the fix commit disagree on how bad it is. The commit calls it "a low-severity bug that's not easy to exploit," yet the advisory rates it High. That kind of mismatch is worth flagging, even if the practical risk stays modest.

The remaining six round out the list: three Medium and three Low. The Mediums cover a keep-alive socket quirk, a related TLS SAN edge case, and a crypto entropy cache that leaks into startup snapshots. That last one, CVE-2026-106074, is the reason the advisory tells you to rebuild rather than just upgrade. If you ship a Single Executable Application or a snapshot, every process from the same copy repeats the same "random" values. For anything minting tokens or session IDs, that's a genuine problem.

The three Low issues are Node 26-only and touch ZIP header caching plus the experimental Permission Model. Two of them involve permission over-grants via wildcard lookups and fs.realpathSync.

The version change and what to do

Here's the interesting part. Starting in October 2026, Node is dropping its two-majors-a-year cadence. From now on there's one major per year, landing in April and promoted to LTS that same October. Versions take year-based numbers, Node 27 in 2027, 28 in 2028, and every release becomes LTS. A new Alpha channel gives library authors a six-month early-testing window.

Node 26 is the last release under the old rules. Node 27 will be the first under the new one, and the odd/even split that confused newcomers for a decade is gone. Wednesday's patch, spanning the final three supported lines, reads as a natural bookend.

People on older versions should note the catch. The advisory repeats a standing warning that end-of-life lines are always affected by every security release. Node 20 (Iron) and Node 25 are both out of support and get no fix here. Node 20 hit EOL on April 30, 2026; Node 25 followed on June 1. Migration is the only real path off those lines.

The advisory reports no known exploitation in the wild. Vercel, though, counters that researchers "demonstrated process-memory disclosure and command execution" on unpatched versions. Both carry weight, and it's worth waiting for hard numbers. As of October 22, none of the ten had a published CVSS score. All were still RESERVED at CVE.org, with no NVD record and nothing in CISA's catalog.

Check your version first. Run node -v or log process.versions.node. You want 22.23.4, 24.22.1, or 26.12.1 or later within your line. Official downloads, Docker Hub, NodeSource apt, and GitHub Actions' setup-node all had fixed builds by Oct 21–22.

If Node is baked into a Docker image, an AWS Lambda container, or any SEA or snapshot, an old exact tag like node:24.22.0 won't move until you rebuild with docker build --pull. Live processes behave the same way: a running instance holds the old binary in memory until you restart it.

One more thing to eyeball on Linux and macOS. Some distributions link Node against a shared system Brotli library. Run ldd "$(command -v node)" | grep -i brotli on Linux or otool -L "$(command -v node)" | grep -i brotli on macOS. A libbrotlidec line means the RCE fix may arrive through a separate brotli package, brew upgrade brotli, for instance, rather than through Node itself.

Keep in mind that npm audit won't catch this. It inspects your project's dependencies, not the runtime. And whatever you do, don't paper over the TLS holes with rejectUnauthorized: false or NODE_TLS_REJECT_UNAUTHORIZED=0. That just disables the exact protection these fixes restore.

Node.js — Node.js 26.12.1 (Current)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 26.12.1 (Current)

Node.js — Node.js 24.22.1 (LTS)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 24.22.1 (LTS)

Node.js — Node.js 22.23.4 (LTS)

Node.js is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts.

Node.js — Node.js 22.23.4 (LTS)