Security releases of Wednesday, October 21, 2026, 10 fixes
What's happening and what to do
Node.js released 22.23.4, 24.22.1, 26.12.1 with 10 security fixes, highest severity HIGH. CVE-2026-111497 is known to be exploited and listed separately. Upgrade to the fixed release for your line.
Standard summary for this kind of threat.
Affected versions
| Ecosystem | Package | Affected | Safe from |
|---|---|---|---|
| Node.js | node | >= 22.0.0, < 22.23.4 or >= 24.0.0, < 24.22.1 or >= 26.0.0, < 26.12.1 | 22.23.4, 24.22.1, 26.12.1 |
Signals over time
- 2026-11-04 21:00First seen here.
Source text
Node.js released 22.23.4, 24.22.1, 26.12.1 with 10 security fixes, highest severity HIGH. CVE-2026-111497 is known to be exploited and listed separately. Upgrade to the fixed release for your line. CVE-2026-105481 (medium): Keep-alive socket process a response that was written before the request was sent CVE-2026-105482 (high): dns.resolve truncates names containing NUL char CVE-2026-105483 (high): TLS certificate hostname bypass when the IP is written fullwidth digits CVE-2026-106069 (high): TLS certificate hostname bypass when the host loosely resolves to an IP address CVE-2026-106070 (low): Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation CVE-2026-106071 (low): Permission Model filesystem over-grant via wildcard radix lookup CVE-2026-106072 (medium): Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints CVE-2026-106073 (low): Permission Model bypass with fs.realpathSync CVE-2026-106074 (medium): crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values