# PHP and Node.js Security, Part 2: The Node.js October 2026 Release

> The Node.js October 2026 security release: 10 CVEs, including a high-severity Brotli bug, fixed in v22.23.4, v24.22.1 and v26.12.1, plus EOL lines still open.

Source: https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-2-nodejs · Published 2026-10-26 · ByteVancer · Security

**Ten CVEs, four rated high, including a Brotli out-of-bounds write. Which Node.js versions fix them, how June and July fit in, and why end-of-life lines stay exposed.**

> **Part 2 of 3: PHP and Node.js security, October 2026** — [Part 1: The October 2026 PHP RCE fixes](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-1-php) · **Part 2: The Node.js October 2026 security release (you're here)** · [Part 3: What unpatched servers do to SEO](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers)

Part 2 of our PHP and Node.js security series, as of 26 Oct 2026. October's Node.js release patches v22, v24 and v26 together, and some of its bugs are second attempts at earlier fixes. Facts come from the nodejs.org security posts and release schedule.

## TL;DR

- The October 2026 release fixes 10 CVEs: 4 high, 3 medium, 3 low.
- Upgrade to v22.23.4, v24.22.1 or v26.12.1.
- Headline: CVE-2026-111497, a Brotli decoder out-of-bounds write that can mean a crash, a memory leak or remote code execution.
- Some October CVEs are incomplete fixes of earlier ones. Patching is continuous, not a one-off.
- v18, v20 and v25 are end-of-life, and "End-of-Life versions are always affected when a security release occurs."

## What's in the October 2026 release

**From the Node.js October 2026 security releases post.**
- **CVE-2026-111497** — Severity: High; What goes wrong: Brotli decoder out-of-bounds write when node:zlib decompresses attacker data (v22, v24, v26)
- **CVE-2026-105482** — Severity: High; What goes wrong: dns.resolve*/reverse truncate at a NUL byte, so an allowlist check and the real lookup disagree
- **CVE-2026-105483** — Severity: High; What goes wrong: TLS hostname check bypass with fullwidth-digit IPs (v24, v26)
- **CVE-2026-106069** — Severity: High; What goes wrong: TLS hostname check bypass with leading-zero or octal IPv4
- **CVE-2026-105481** — Severity: Medium; What goes wrong: A keep-alive socket accepts a response that arrived before the request
- **CVE-2026-106072** — Severity: Medium; What goes wrong: Non-canonical IPv4 lets a DNS SAN authenticate an IP endpoint
- **CVE-2026-106074** — Severity: Medium; What goes wrong: crypto.randomUUID()/randomInt() caches frozen into snapshots or SEA repeat predictable values
- **CVE-2026-106070** — Severity: Low; What goes wrong: ZipFile prefix bytes (v26)
- **CVE-2026-106071** — Severity: Low; What goes wrong: Permission Model wildcard over-grant (v26)
- **CVE-2026-106073** — Severity: Low; What goes wrong: fs.realpathSync skips the permission read check

The release also updates dependencies: c-ares, the CA certificates (after an eMudhra intermediate CA compromise), OpenSSL, SQLite and undici.

## Which Node.js version fixes it

**Upgrade targets, October 2026**
- **v22.23.4** Node.js 22 — Maintenance until 30 Apr 2027.
- **v24.22.1** Node.js 24 — Maintenance from 20 Oct 2026 to 30 Apr 2028.
- **v26.12.1** Node.js 26 — LTS from 28 Oct 2026 to 30 Apr 2029.

*Fixed versions from the Node.js security post and nodejs.org/dist/index.json; dates from the nodejs/release schedule.*

*Read-only. Check every place Node runs: servers, containers, CI runners.*
```bash
# Runtime version
node -v

# Bundled library versions (OpenSSL, zlib, and more)
node -p process.versions

# What a container image really ships (use your own tag)
docker run --rm node:22 node -v
```

## Why the Brotli bug matters most

Per the Node.js post, CVE-2026-111497 can cause a crash, a process-memory leak or remote code execution when an app decompresses attacker-supplied Brotli data through node:zlib. Any service that inflates compressed input from the outside should treat this one as today's job.

## What happens if you don't patch

- Brotli (CVE-2026-111497): a crash, leaked process memory or remote code execution.
- DNS and TLS (CVE-2026-105482, CVE-2026-105483 on v24/v26, CVE-2026-106069): an allowlist or hostname check can pass for a host it should reject.
- Snapshots and SEA (CVE-2026-106074): "random" UUIDs and integers repeat and become predictable.
- Keep-alive (CVE-2026-105481): a client can accept a response that arrived before its request.

Skipped July too? Then you're also open to HTTP/2 remote memory exhaustion (CVE-2026-56846, v22 and v24), an HTTP/2 heap use-after-free (CVE-2026-56848) and a Permission Model path escape (CVE-2026-58043), all rated high. A crashed Node process is a 5xx for every visitor and every crawler, which is where [Part 3 on SEO](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers) picks up.

## Why patching is continuous

**Three 2026 releases, one chain**
June → July → October → Next release

1. **June** — 22.23.0, 24.17.0, 26.3.1: WebCrypto AES overflow abort (CVE-2026-48933), TLS wildcard depth bypass (CVE-2026-48618).
2. **July** — 22.23.2, 24.18.1, 26.5.1: HTTP/2 memory exhaustion and use-after-free, Permission Model escape, header-truncation smuggling.
3. **October** — 22.23.4, 24.22.1, 26.12.1: ten CVEs, including second attempts at CVE-2026-48930 and CVE-2026-48931.
4. **Next release** — Same drill: check versions, patch, verify.

CVE-2026-105482 is an incomplete fix of CVE-2026-48930, and CVE-2026-105481 of CVE-2026-48931. Patching once in June didn't finish the job; staying current did.

## End-of-life lines: v18, v20, v25

**From the nodejs/release schedule, as of 26 Oct 2026.**
- **v18** — Status: End of life; End of life: 30 Apr 2025
- **v20** — Status: End of life (last release v20.20.2, 24 Mar 2026); End of life: 30 Apr 2026
- **v25** — Status: End of life; End of life: 1 Jun 2026
- **v22** — Status: Maintenance; End of life: 30 Apr 2027
- **v24** — Status: Maintenance since 20 Oct 2026; End of life: 30 Apr 2028
- **v26** — Status: LTS from 28 Oct 2026; End of life: 30 Apr 2029

> **EOL means always affected** — Every Node.js security post says it: "End-of-Life versions are always affected when a security release occurs." A v20 server got no October fix. The fix is a line upgrade to v22, v24 or v26.

## Get the printable checklist

Both runtimes' version tables, EOL lines and a patch-day checklist in one PDF: [PHP + Node.js security patch checklist (PDF, Oct 2026)](https://bytevancer.com/downloads/php-nodejs-security-patch-checklist-oct-2026.pdf). On PHP too? Start with [Part 1](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-1-php). Want someone else on release day? See our [Node.js maintenance and security updates](https://bytevancer.com/services/maintenance-support).

## The whole series

1. [Part 1: The October 2026 PHP RCE fixes](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-1-php)
2. **Part 2: The Node.js October 2026 security release (this post)**
3. [Part 3: What unpatched servers do to SEO](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers)

Next up: [Part 3](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers) covers what an unpatched server does to your SEO, in Google's own words.

## Frequently asked questions

**Which Node.js versions fix the October 2026 vulnerabilities?**
v22.23.4, v24.22.1 and v26.12.1. End-of-life lines such as v18, v20 and v25 get no fix.

**What is CVE-2026-111497?**
A high-severity Brotli decoder out-of-bounds write in node:zlib that can lead to a crash, a memory leak or remote code execution on v22, v24 and v26.

**Is Node.js 20 still supported?**
No. Node.js 20 reached end of life on 30 Apr 2026, and end-of-life versions are always affected when a security release occurs.

**Is any Node.js core CVE in CISA's KEV catalog?**
No Node.js core CVE was in CISA's catalog as of version 2026.10.23. Four October fixes are still rated high.

**How do I check my Node.js version?**
Run node -v, and node -p process.versions for bundled libraries. Check containers and CI runners too.

## Keep reading

- [PHP and Node.js Security, Part 1: The October 2026 PHP RCE Fixes](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-1-php) — PHP CVE-2026-109618 and CVE-2026-109619 explained: affected SAPIs, fixed versions 8.2.35 to 8.5.12, stopgaps, and what happens to a server you don't patch.
- [PHP and Node.js Security, Part 3: What Unpatched Servers Do to SEO](https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-3-seo-impact-unpatched-servers) — How an unpatched PHP or Node.js server hurts SEO: Google's "This site may be hacked" label, browser interstitials, 5xx crawl slowdown, and what to patch first.
- [All ByteVancer engineering articles](https://bytevancer.com/blog)

## Rather not track Node.js release lines yourself?

We keep Node.js apps on supported lines, apply security releases, and test before and after every upgrade. See our [Node.js security updates and app maintenance](https://bytevancer.com/services/maintenance-support) or [talk to the team](https://bytevancer.com/contact).

## Sources

- [Node.js — October 2026 security releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
- [Node.js — July 2026 security releases](https://nodejs.org/en/blog/vulnerability/july-2026-security-releases)
- [Node.js — June 2026 security releases](https://nodejs.org/en/blog/vulnerability/june-2026-security-releases)
- [Node.js — release index (dist/index.json, checked Oct 26, 2026)](https://nodejs.org/dist/index.json)
- [GitHub — nodejs/release, release schedule](https://github.com/nodejs/release#release-schedule)
- [Node.js — End-of-Life versions](https://nodejs.org/en/about/eol)
- [CISA — Known Exploited Vulnerabilities catalog feed (version 2026.10.23)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

---

*This is the Markdown copy of https://bytevancer.com/blog/php-nodejs-security-vulnerabilities-part-2-nodejs — the page itself has the interactive charts and diagrams.*