Blog: update october 2026 security release post

apps/site/pages/en/blog/vulnerability/october-2026-security-releases.md

@@ -1,12 +1,93 @@
 ---
-date: 2026-10-14T03:00:00.000Z
+date: 2026-10-21T22:00:00.000Z
 category: vulnerability
 title: Wednesday, October 21, 2026 Security Releases
 slug: october-2026-security-releases
 layout: blog-post
 author: The Node.js Project
 ---
 
+## Security releases available
+
+Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the
+following issues.
+
+This security release includes the following dependency updates to address public vulnerabilities:
+
+- c-ares on 26.x, 24.x, 22.x
+- ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x
+- OpenSSL on 24.x, 22.x
+- SQLite on 22.x
+- Undici on 26.x, 24.x, 22.x
+
+## dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high)
+
+This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
+
+Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.
+
+## TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)
+
+This vulnerability affects Node.js **26.x** and **24.x**.
+
+Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.
+
+## TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)
+
+This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
+
+Thank you, to anagnorisis2peripeteia for reporting this vulnerability and thank you mcollina for fixing it.
+
+## Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)
+
+A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.
+
+This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
+
+Thank you, to mcollina for reporting this vulnerability and thank you aduh95 for fixing it.
+
+## Keep-alive socket process a response that was written before the request was sent (CVE-2026-105481) - (medium)
+
+This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
+
+Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.
+
+## Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (CVE-2026-106072) - (medium)
+
+This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
+
+Thank you, to br41ny for reporting this vulnerability and thank you mcollina for fixing it.
+
+## crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (CVE-2026-106074) - (medium)
+
+This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
+
+Thank you, to gesposito for reporting this vulnerability and thank you panva for fixing it.
+
+## Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (CVE-2026-106070) - (low)
+
+This vulnerability affects Node.js **26.x**.
+
+Thank you, to startimeash for reporting this vulnerability and thank you mcollina for fixing it.
+
+## Permission Model filesystem over-grant via wildcard radix lookup (CVE-2026-106071) - (low)
+
+This vulnerability affects Node.js **26.x**.
+
+Thank you, to malikhamzaiqbal for reporting this vulnerability and thank you jasnell for fixing it.
+
+## Permission Model bypass with fs.realpathSync (CVE-2026-106073) - (low)
+
+This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
+
+Thank you, to 0xoroot for reporting this vulnerability and thank you RafaelGSS for fixing it.
+
+## Downloads and release details
+
+- [Node.js v22.23.4](/blog/release/v22.23.4/)
+- [Node.js v24.22.1](/blog/release/v24.22.1/)
+- [Node.js v26.12.1](/blog/release/v26.12.1/)
+
 # Summary
 
 The Node.js project will release new versions of the 26.x, 24.x, 22.x

apps/site/site.json

@@ -29,8 +29,8 @@
   "websiteBanners": {
     "index": {
       "startDate": "2026-10-14T03:00:00.000Z",
-      "endDate": "2026-10-21T03:00:00.000Z",
-      "text": "New security releases to be made available Wednesday, October 21, 2026",
+      "endDate": "2026-10-28T03:00:00.000Z",
+      "text": "October 2026 security releases are available",
       "link": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases",
       "type": "warning"
     }