Node.js October 2026 Security Releases: CVE and Upgrade Matrix

The Node.js security releases published October 21, 2026 correct ten Node.js CVEs plus bundled dependency issues. The fixed releases are 22.23.4, 24.22.1 et 26.12.1. The highest severity is High, but priority depends on which APIs an application uses and which attacker-controlled inputs reach them.

The official Node.js release advisory covers DNS truncation, TLS hostname validation, Brotli memory corruption, keep-alive response confusion, startup-snapshot entropy reuse, ZIP parsing and Permission Model bypasses. It also updates c-ares, eMudhra CA material, OpenSSL, SQLite and Undici on applicable release lines.

Fixed release matrix

End-of-life Node.js lines do not receive these fixes. Moving an application to a currently supported line is part of remediation; copying individual commits into an unsupported runtime creates a private maintenance burden and does not provide normal project security support.

Exposure matrix

Upgrade the artifact that actually runs

A developer workstation upgrade does not remediate a container image, serverless runtime, packaged desktop application or single executable application. Inventory Node.js by deployment artifact:

• base images and image digests;
• OS packages, tarball installations and version managers;
• CI runners and build images;
• serverless and edge runtime versions;
• Electron or desktop applications that bundle Node.js;
• startup snapshots and single executable applications that must be rebuilt.

Use read-only checks in the deployed environment:

node --version
node -p "process.versions"
node -p "process.execPath"
npm ls undici --all 2>/dev/null

# Container example: verify the immutable image and runtime together
docker inspect --format '{{.Image}} {{.Config.Image}}' CONTAINER
docker exec CONTAINER node -p "process.version + ' ' + process.execPath"

Test behavior without weaponizing the flaws

Prefer regression tests that reject unsafe input rather than reproducing memory corruption or certificate bypass. Add cases for embedded NUL characters, non-canonical IP spellings, excessive or malformed compressed responses, unexpected keep-alive data and Permission Model boundary paths. Run them in an isolated test environment against the upgraded runtime and record the expected rejection behavior.

For CVE-2026-106074, rebuild snapshots and SEAs with the fixed runtime. Updating the machine’s system Node.js does not alter an already produced executable. Confirm that parallel instances no longer repeat snapshot-seeded identifiers and that application uniqueness assumptions are valid independently of the runtime fix.

Bundled dependencies need their own inventory

The Node.js release updates bundled components, including Undici, but an application can also declare its own undici dependency. The runtime upgrade and the application dependency upgrade are separate checks. Record both process.versions and the resolved package tree, rebuild lockfiles only through the project’s controlled process, and verify the deployed artifact rather than the source branch.

Conclusion

Move supported deployments to Node.js 22.23.4, 24.22.1 or 26.12.1, then verify the active runtime in every artifact. Use API-level exposure questions to prioritize testing, rebuild snapshots and packaged applications, and inspect separately installed dependencies. The fixed version is the start of closure; the deployed executable and regression evidence complete it.