Part 2 of our PHP and Node.js security series, as of 26 Oct 2026. October's Node.js release patches v22, v24 and v26 together, and some of its bugs are second attempts at earlier fixes. Facts come from the nodejs.org security posts and release schedule.
TL;DR
- The October 2026 release fixes 10 CVEs: 4 high, 3 medium, 3 low.
- Upgrade to v22.23.4, v24.22.1 or v26.12.1.
- Headline: CVE-2026-111497, a Brotli decoder out-of-bounds write that can mean a crash, a memory leak or remote code execution.
- Some October CVEs are incomplete fixes of earlier ones. Patching is continuous, not a one-off.
- v18, v20 and v25 are end-of-life, and "End-of-Life versions are always affected when a security release occurs."
What's in the October 2026 release
| CVE | Severity | What goes wrong |
|---|---|---|
| CVE-2026-111497 | High | Brotli decoder out-of-bounds write when node:zlib decompresses attacker data (v22, v24, v26) |
| CVE-2026-105482 | High | dns.resolve*/reverse truncate at a NUL byte, so an allowlist check and the real lookup disagree |
| CVE-2026-105483 | High | TLS hostname check bypass with fullwidth-digit IPs (v24, v26) |
| CVE-2026-106069 | High | TLS hostname check bypass with leading-zero or octal IPv4 |
| CVE-2026-105481 | Medium | A keep-alive socket accepts a response that arrived before the request |
| CVE-2026-106072 | Medium | Non-canonical IPv4 lets a DNS SAN authenticate an IP endpoint |
| CVE-2026-106074 | Medium | crypto.randomUUID()/randomInt() caches frozen into snapshots or SEA repeat predictable values |
| CVE-2026-106070 | Low | ZipFile prefix bytes (v26) |
| CVE-2026-106071 | Low | Permission Model wildcard over-grant (v26) |
| CVE-2026-106073 | Low | fs.realpathSync skips the permission read check |
The release also updates dependencies: c-ares, the CA certificates (after an eMudhra intermediate CA compromise), OpenSSL, SQLite and undici.
Which Node.js version fixes it
- Node.js 22
- v22.23.4Maintenance until 30 Apr 2027.
- Node.js 24
- v24.22.1Maintenance from 20 Oct 2026 to 30 Apr 2028.
- Node.js 26
- v26.12.1LTS from 28 Oct 2026 to 30 Apr 2029.
Fixed versions from the Node.js security post and nodejs.org/dist/index.json; dates from the nodejs/release schedule.
# Runtime version
node -v
# Bundled library versions (OpenSSL, zlib, and more)
node -p process.versions
# What a container image really ships (use your own tag)
docker run --rm node:22 node -vWhy the Brotli bug matters most
Per the Node.js post, CVE-2026-111497 can cause a crash, a process-memory leak or remote code execution when an app decompresses attacker-supplied Brotli data through node:zlib. Any service that inflates compressed input from the outside should treat this one as today's job.
What happens if you don't patch
- Brotli (CVE-2026-111497): a crash, leaked process memory or remote code execution.
- DNS and TLS (CVE-2026-105482, CVE-2026-105483 on v24/v26, CVE-2026-106069): an allowlist or hostname check can pass for a host it should reject.
- Snapshots and SEA (CVE-2026-106074): "random" UUIDs and integers repeat and become predictable.
- Keep-alive (CVE-2026-105481): a client can accept a response that arrived before its request.
Skipped July too? Then you're also open to HTTP/2 remote memory exhaustion (CVE-2026-56846, v22 and v24), an HTTP/2 heap use-after-free (CVE-2026-56848) and a Permission Model path escape (CVE-2026-58043), all rated high. A crashed Node process is a 5xx for every visitor and every crawler, which is where Part 3 on SEO picks up.
Why patching is continuous
- 01
June
22.23.0, 24.17.0, 26.3.1: WebCrypto AES overflow abort (CVE-2026-48933), TLS wildcard depth bypass (CVE-2026-48618).
- 02
July
22.23.2, 24.18.1, 26.5.1: HTTP/2 memory exhaustion and use-after-free, Permission Model escape, header-truncation smuggling.
- 03
October
22.23.4, 24.22.1, 26.12.1: ten CVEs, including second attempts at CVE-2026-48930 and CVE-2026-48931.
- 04
Next release
Same drill: check versions, patch, verify.
CVE-2026-105482 is an incomplete fix of CVE-2026-48930, and CVE-2026-105481 of CVE-2026-48931. Patching once in June didn't finish the job; staying current did.
End-of-life lines: v18, v20, v25
| Line | Status | End of life |
|---|---|---|
| v18 | End of life | 30 Apr 2025 |
| v20 | End of life (last release v20.20.2, 24 Mar 2026) | 30 Apr 2026 |
| v25 | End of life | 1 Jun 2026 |
| v22 | Maintenance | 30 Apr 2027 |
| v24 | Maintenance since 20 Oct 2026 | 30 Apr 2028 |
| v26 | LTS from 28 Oct 2026 | 30 Apr 2029 |
Get the printable checklist
Both runtimes' version tables, EOL lines and a patch-day checklist in one PDF: PHP + Node.js security patch checklist (PDF, Oct 2026). On PHP too? Start with Part 1. Want someone else on release day? See our Node.js maintenance and security updates.
The whole series
- Part 1: The October 2026 PHP RCE fixes
- Part 2: The Node.js October 2026 security release (this post)
- Part 3: What unpatched servers do to SEO
Next up: Part 3 covers what an unpatched server does to your SEO, in Google's own words.