Node.js released a security update on Oct. 21 for its 26.x, 24.x and 22.x branches, with fixes in versions 26.12.1, 24.22.1 and 22.23.4, BlockBeats reported on Oct. 22.
High-risk issues
The bulletin listed 10 vulnerabilities: four high risk, three medium risk and three low risk. BlockBeats identified high-risk CVE-2026-111497 as an out-of-bounds write in the Brotli decoder that could lead to remote code execution. Other high-risk issues included null-byte handling in DNS resolution and TLS certificate-hostname validation bypasses.
Other fixes and support status
The release also addressed persistent-connection response handling, duplicate random-number caching and permission-model issues, while updating c-ares, OpenSSL and Undici dependencies. The report said unsupported Node.js versions could also be affected and advised users to move to the latest supported release.
These details are attributed to the Node.js security release as summarized by BlockBeats; the flash links the underlying project advisory for operators who need the complete affected-version matrix.