From 54b0dae8b9ea4f1d1d777169771c249c6e2b8b3a Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 12:39:15 +0200 Subject: [PATCH 1/6] Blog: update october 2026 security release post --- .../october-2026-security-releases.md | 84 ++++++++++++++++++- 1 file changed, 83 insertions(+), 1 deletion(-) diff --git a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md index 4ade2bc484837..254e24b2169e9 100644 --- a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md +++ b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md @@ -1,5 +1,5 @@ --- -date: 2026-10-14T03:00:00.000Z +date: 2026-10-20T22:00:00.000Z category: vulnerability title: Wednesday, October 21, 2026 Security Releases slug: october-2026-security-releases @@ -7,6 +7,88 @@ layout: blog-post author: The Node.js Project --- +## Security releases available + +Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the +following issues. + +This security release includes the following dependency updates to address public vulnerabilities: + +- c-ares on 26.x, 24.x, 22.x +- ca-cert on 26.x, 24.x, 22.x +- openssl on 24.x, 22.x +- sqlite on 22.x +- undici on 26.x, 24.x, 22.x + +## dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high) + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it. + +## TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high) + +This vulnerability affects Node.js **26.x** and **24.x**. + +Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it. + +## TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high) + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +Thank you, to anagnorisis2peripeteia for reporting this vulnerability and thank you mcollina for fixing it. + +## Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high) + +A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +Thank you, to mcollina for reporting this vulnerability and thank you aduh95 for fixing it. + +## Keep-alive socket process a response that was written before the request was sent (CVE-2026-105481) - (medium) + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it. + +## Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (CVE-2026-106072) - (medium) + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +Thank you, to br41ny for reporting this vulnerability and thank you mcollina for fixing it. + +## crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (CVE-2026-106074) - (medium) + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +Thank you, to gesposito for reporting this vulnerability and thank you panva for fixing it. + +## Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (CVE-2026-106070) - (low) + +This vulnerability affects Node.js **26.x**. + +Thank you, to startimeash for reporting this vulnerability and thank you mcollina for fixing it. + +## Permission Model filesystem over-grant via wildcard radix lookup (CVE-2026-106071) - (low) + +This vulnerability affects Node.js **26.x**. + +Thank you, to malikhamzaiqbal for reporting this vulnerability and thank you jasnell for fixing it. + +## Permission Model bypass with fs.realpathSync (CVE-2026-106073) - (low) + +This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. + +Thank you, to 0xoroot for reporting this vulnerability and thank you RafaelGSS for fixing it. + + +## Downloads and release details + +- [Node.js v22.23.4](/blog/release/v22.23.4/) +- [Node.js v24.22.1](/blog/release/v24.22.1/) +- [Node.js v26.12.1](/blog/release/v26.12.1/) + # Summary The Node.js project will release new versions of the 26.x, 24.x, 22.x From 0490e19da232809f81f6ce197907390a977c09d0 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 13:33:02 +0200 Subject: [PATCH 2/6] fixup! Blog: update october 2026 security release post --- .../en/blog/vulnerability/october-2026-security-releases.md | 1 - 1 file changed, 1 deletion(-) diff --git a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md index 254e24b2169e9..c0bfea48a3e93 100644 --- a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md +++ b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md @@ -82,7 +82,6 @@ This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. Thank you, to 0xoroot for reporting this vulnerability and thank you RafaelGSS for fixing it. - ## Downloads and release details - [Node.js v22.23.4](/blog/release/v22.23.4/) From f45ca64fde55e09b55bff638b77ddb474db3aa35 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 13:34:40 +0200 Subject: [PATCH 3/6] fixup! Blog: update october 2026 security release post --- .../blog/vulnerability/october-2026-security-releases.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md index c0bfea48a3e93..ee4d23dd577d9 100644 --- a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md +++ b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md @@ -15,10 +15,10 @@ following issues. This security release includes the following dependency updates to address public vulnerabilities: - c-ares on 26.x, 24.x, 22.x -- ca-cert on 26.x, 24.x, 22.x -- openssl on 24.x, 22.x -- sqlite on 22.x -- undici on 26.x, 24.x, 22.x +- ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x +- OpenSSL on 24.x, 22.x +- SQLite on 22.x +- Undici on 26.x, 24.x, 22.x ## dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high) From 602a4bbfec421a0b16f88e7c8fff37e6551522fe Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 13:43:05 +0200 Subject: [PATCH 4/6] fixup! fixup! Blog: update october 2026 security release post --- apps/site/site.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/site/site.json b/apps/site/site.json index 37de52a328de0..05d5aa112c98f 100644 --- a/apps/site/site.json +++ b/apps/site/site.json @@ -30,7 +30,7 @@ "index": { "startDate": "2026-10-14T03:00:00.000Z", "endDate": "2026-10-21T03:00:00.000Z", - "text": "New security releases to be made available Wednesday, October 21, 2026", + "text": "New security releases available since Wednesday, October 21, 2026", "link": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "type": "warning" } From ab3fa7f2774fd0ce292bc62769c7bcb5e3661d56 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 13:44:04 +0200 Subject: [PATCH 5/6] fixup! fixup! Blog: update october 2026 security release post --- apps/site/site.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/site/site.json b/apps/site/site.json index 05d5aa112c98f..16e6283a4ad04 100644 --- a/apps/site/site.json +++ b/apps/site/site.json @@ -30,7 +30,7 @@ "index": { "startDate": "2026-10-14T03:00:00.000Z", "endDate": "2026-10-21T03:00:00.000Z", - "text": "New security releases available since Wednesday, October 21, 2026", + "text": "October 2026 security releases are available", "link": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "type": "warning" } From 5535dd5632129d014b1609935045507453a00d29 Mon Sep 17 00:00:00 2001 From: Antoine du Hamel Date: Wed, 21 Oct 2026 13:51:15 +0200 Subject: [PATCH 6/6] Apply batched suggestions from code review Co-authored-by: Antoine du Hamel Signed-off-by: Antoine du Hamel --- .../en/blog/vulnerability/october-2026-security-releases.md | 2 +- apps/site/site.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md index ee4d23dd577d9..80095c4f2a4e4 100644 --- a/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md +++ b/apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md @@ -1,5 +1,5 @@ --- -date: 2026-10-20T22:00:00.000Z +date: 2026-10-21T22:00:00.000Z category: vulnerability title: Wednesday, October 21, 2026 Security Releases slug: october-2026-security-releases diff --git a/apps/site/site.json b/apps/site/site.json index 16e6283a4ad04..1c61c4d9f0a61 100644 --- a/apps/site/site.json +++ b/apps/site/site.json @@ -29,7 +29,7 @@ "websiteBanners": { "index": { "startDate": "2026-10-14T03:00:00.000Z", - "endDate": "2026-10-21T03:00:00.000Z", + "endDate": "2026-10-28T03:00:00.000Z", "text": "October 2026 security releases are available", "link": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases", "type": "warning"