{"id":"nodejs-october-2026-security-releases","url":"https://compromised.live/t/nodejs-october-2026-security-releases","kind":"security_release","tier":4,"severity":"high","title":"Node.js: Security releases of Wednesday, October 21, 2026, 10 fixes","summary":"Node.js released 22.23.4, 24.22.1, 26.12.1 with 10 security fixes, highest severity HIGH. CVE-2026-111497 is known to be exploited and listed separately. Upgrade to the fixed release for your line.","summary_source":"template","affected":[{"ecosystem":"Node.js","package":"node","affected":">= 22.0.0, < 22.23.4 or >= 24.0.0, < 24.22.1 or >= 26.0.0, < 26.12.1","fixed":["22.23.4","24.22.1","26.12.1"]}],"epss":null,"kev":null,"first_seen":"2026-11-04T21:00:45.886Z","updated_at":"2026-11-04T21:00:45.886Z","campaign":null,"status":"active","details":"Node.js released 22.23.4, 24.22.1, 26.12.1 with 10 security fixes, highest severity HIGH. CVE-2026-111497 is known to be exploited and listed separately. Upgrade to the fixed release for your line.\n\nCVE-2026-105481 (medium): Keep-alive socket process a response that was written before the request was sent\nCVE-2026-105482 (high): dns.resolve truncates names containing NUL char\nCVE-2026-105483 (high): TLS certificate hostname bypass when the IP is written fullwidth digits\nCVE-2026-106069 (high): TLS certificate hostname bypass when the host loosely resolves to an IP address\nCVE-2026-106070 (low): Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation\nCVE-2026-106071 (low): Permission Model filesystem over-grant via wildcard radix lookup\nCVE-2026-106072 (medium): Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints\nCVE-2026-106073 (low): Permission Model bypass with fs.realpathSync\nCVE-2026-106074 (medium): crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values","aliases":["CVE-2026-105481","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-106070","CVE-2026-106071","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","nodejs-october-2026-security-releases"],"sources":[{"name":"nodejs","id":"nodejs-october-2026-security-releases","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"}]}