Node.js: October 2026 security releases fix DNS truncation, TLS hostname bypasses, Brotli RCE and HTTP keep-alive flaws (CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074)
Severity: high · Patch status: patched · Since 2026-10-21 · CVE-2026-105481, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106074, CVE-2026-111497, CVE-2026-48618, CVE-2026-48930, CVE-2026-48931
The Node.js Project released security updates for the 26.x, 24.x and 22.x lines on 2026-10-21 addressing seven vulnerabilities. High-severity issues include dns.resolve() silently truncating hostnames at NUL bytes (bypassing allowlist validation), TLS hostname verification bypasses via fullwidth-digit IP spellings and non-canonical IPv4 literals like leading-zero octets, and a Brotli decoder out-of-bounds write in node:zlib that can enable remote code execution. Medium issues cover HTTP keep-alive socket response confusion, DNS SANs authenticating IP endpoints, and entropy caches for crypto.randomUUID()/randomInt() being baked into startup snapshots, causing repeated values across processes. Dependency updates include c-ares, OpenSSL, SQLite, Undici and ca-certificates. All users on affected lines should upgrade promptly.
What to do
- Upgrade Node.js deployments on 26.x, 24.x or 22.x to the October 2026 security releases immediately, prioritising internet-facing services using TLS hostname verification or node:zlib Brotli decompression
- Rebuild any single executable applications or --build-snapshot artifacts created with useSnapshot so entropy caches are not baked in, and regenerate any UUIDs/randomInt values issued from snapshot-built processes
- Audit applications that validate hostnames against allowlists then resolve via dns.resolve*() for NUL-byte truncation exposure
- Rebuild container images and dependencies that bundle affected Node.js versions and redeploy
Sources
All live incidents on Threat Watch
