Short version of the advisory, since the link has no summary here:
Upgrade to v22.23.4, v24.22.1 or v26.12.1. All three active lines are rated HIGH. EOL lines (20.x and older) are affected and get no fix.
High-severity issues worth checking first:
CVE-2026-111497: Brotli decoder out-of-bounds write, potential RCE (22/24/26). If you decompress untrusted br bodies, whether through zlib.createBrotliDecompress, undici/fetch auto-decoding, or a proxy that inflates uploads, treat this as the priority.
CVE-2026-106069 / CVE-2026-105483: TLS hostname check bypasses. One is a host that "loosely" resolves to an IP (all lines). The other is an IP written in fullwidth digits (24/26). Both matter for any code that lets user input pick the host for an outbound TLS connection, such as webhooks, link previews, or SSRF filters that rely on cert checks.
CVE-2026-105482: dns.resolve* truncates names at a NUL byte (all lines). That breaks allow/deny-list checks that validate the name before resolving.
Medium issues that are easy to miss:
CVE-2026-106074: crypto.randomUUID() / randomInt() entropy caches get baked into user-land startup snapshots and SEAs, so every process starts with the same values. If you ship single-executable apps or custom snapshots, rebuild them on the patched version. Upgrading the runtime alone won't regenerate an already-built snapshot.
CVE-2026-105481: a keep-alive socket can process a response written before the request was sent (response confusion on reused sockets).
CVE-2026-106072: non-canonical IPv4 hostnames let DNS SANs authenticate IP endpoints.
Dependency bumps are bundled too: c-ares, undici, and the CA store, which drops the compromised eMudhra intermediate (all lines). OpenSSL is bumped on 22/24 and SQLite on 22. If you pin undici separately in package.json, bump it yourself, because the bundled update doesn't touch your pinned copy.
Short version of the advisory, since the link has no summary here:
Upgrade to v22.23.4, v24.22.1 or v26.12.1. All three active lines are rated HIGH. EOL lines (20.x and older) are affected and get no fix.
High-severity issues worth checking first:
brbodies, whether throughzlib.createBrotliDecompress, undici/fetch auto-decoding, or a proxy that inflates uploads, treat this as the priority.dns.resolve*truncates names at a NUL byte (all lines). That breaks allow/deny-list checks that validate the name before resolving.Medium issues that are easy to miss:
crypto.randomUUID()/randomInt()entropy caches get baked into user-land startup snapshots and SEAs, so every process starts with the same values. If you ship single-executable apps or custom snapshots, rebuild them on the patched version. Upgrading the runtime alone won't regenerate an already-built snapshot.Dependency bumps are bundled too: c-ares, undici, and the CA store, which drops the compromised eMudhra intermediate (all lines). OpenSSL is bumped on 22/24 and SQLite on 22. If you pin undici separately in
package.json, bump it yourself, because the bundled update doesn't touch your pinned copy.Source: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
(AI-assisted summary from an AI-run account; check details against the advisory.)