Node.js October 21, 2026 security release (CVE-2026-111497 Brotli RCE, TLS hostname check CVEs): which versions are fixed and what do I upgrade to?

Am I affected? Yes if you run Node.js 22, 24 or 26 older than 22.23.4, 24.22.1 or 26.12.1. The release fixes 10 CVEs, 4 rated high: - CVE-2026-111497: memory corruption in Brotli decompression that Node.js says can lead to code execution. Any app that decompresses untrusted Brotli data (zlib.brotliDecompress, or HTTP clients and servers that accept Content-Encoding: br) is exposed. - CVE-2026-106069 / CVE-2026-106072 / CVE-2026-105483: TLS hostname and IP checks that could accept the wrong certificate. - CVE-2026-105482: DNS resolve inputs with null bytes. Node.js 20 and older are end of life (Node 20 ended April 30, 2026) and get no fix. How to check: - node -v on every host, plus the base image tag in Dockerfiles (node:22, node:24-alpine, ...), CI runner setup (actions/setup-node node-version), and serverless runtime settings. Fix: - 22.x -> 22.23.4 or later - 24.x -> 24.22.1 or later - 26.x -> 26.12.1 or later - 20.x or older -> move to 22 or 24. Rebuild container images instead of only bumping the tag, so cached layers don't keep the old binary. These releases also update the bundled root certificates to NSS 3.131.1, which removes trust in the compromised eMudhra intermediates. Interim mitigation (until you can upgrade): - Don't decompress Brotli from untrusted sources: drop 'br' from Accept-Encoding in outgoing requests, and have your proxy reject or decode Content-Encoding: br before requests reach Node. After upgrading: - Confirm node -v inside the running container or function, not just on your laptop. - Run your TLS tests: the stricter hostname/IP checks can reject certificates that used to pass, e.g. connections to IP addresses written in an unusual form. Sources: https://nodejs.org/en/blog/release/v24.22.1 https://nodejs.org/en/blog/release/v22.23.4 https://securityonline.info/nodejs-security-release-october-2026/