Node.js October 2026 Security Release: Node2Shell and 9 More Fixes

Last updated: 24 October 2026. Sources are listed at the end.

On 21 October 2026, the Node.js project shipped its October security release. It fixes 10 vulnerabilities across all supported release lines. Four are rated High, and one of them, nicknamed “Node2Shell”, can lead to remote code execution. This Node.js security release guide explains what changed, who needs to act and how to update every place Node runs.

The short answer

• Update to v22.23.4, v24.22.1 or v26.12.1 (or later), depending on your release line.
• Node.js 20, 25 and 18 are end of life and get no fix. Plan your move to 22 or 24 now.
• Rebuild containers and single executable apps, not just your laptop.

Which versions are fixed?

The four High-severity bugs

CVE-2026-111497 “Node2Shell”: Brotli decoder overflow

This is the big one. The Brotli decompressor bundled with Node has an out-of-bounds write. If your app decompresses Brotli data that an attacker controls, it can crash, leak memory or, in the worst case, run code. That includes zlib calls, fetch() responses from other servers and Express 5 body parsers that accept compressed request bodies. It affects 22, 24 and 26.

Imperva researchers showed working code execution against the official 24.22.0 arm64 build through Express 5. Their exploit was unreliable and needed several attempts, but it proves the risk is real. Version 24.22.1 blocks it. There is no configuration workaround inside Node.

CVE-2026-106069 and CVE-2026-105483: TLS hostname check bypass

Both bugs let a certificate pass the hostname check when it shouldn’t. The first uses IPv4 addresses with leading zeros, which URL parsing and the operating system read differently. The second uses fullwidth digits and is a regression from an earlier fix. As a result, a client could trust the wrong server. The first affects 22, 24 and 26, while the second affects only 24 and 26.

CVE-2026-105482: DNS lookups cut short at a NUL byte

dns.resolve*() and dns.reverse() stopped reading a hostname at a NUL byte. Consequently, an allowlist check could approve a name that differs from the one actually resolved. It finishes an incomplete fix from earlier this year.

The other six fixes

• Medium: a keep-alive socket response guard (CVE-2026-105481), non-canonical IPv4 names matched against DNS SANs (CVE-2026-106072), and randomUUID()/randomInt() entropy caches frozen into startup snapshots (CVE-2026-106074).
• Low: a ZIP header issue and a permission-model wildcard (26.x only), plus an fs.realpathSync permission bypass on all lines.

The CVE-2026-106074 fix needs extra work. If you build startup snapshots or single executable applications (SEA), rebuild them with the patched Node. Otherwise, every copy shares the same frozen random values.

The release also updates bundled libraries, including c-ares 1.34.9, undici and the root certificate store. Notably, the new root store drops trust in the compromised eMudhra intermediate CAs; see our eMudhra guide.

How to check and update

Your machine or server

# Which version is running?
node -v

# nvm users: install the fix and make it the default
nvm install 24.22.1 --reinstall-packages-from=current
nvm alias default 24.22.1

Also check the Node version inside your process manager. For example, PM2 and systemd services keep running the old binary until you restart them.

Docker

The official node:22, node:24, node:26, lts and Alpine tags carried the fix by 22 October. However, a pull only helps if you rebuild:

docker build --pull --no-cache -t myapp:patched .
docker exec <container> node --version

Pin a fixed tag, such as node:24.22.1-alpine, so an old cached layer can’t come back.

Distribution packages

Some distributions build Node against the system Brotli library instead of the bundled copy. In that case, the Node2Shell fix comes from the distribution’s brotli package, not from nodejs. Check with:

ldd "$(which node)" | grep -i brotli || echo "uses bundled Brotli"

On Debian, both packages were still unfixed when we checked on 24 October. So, if you rely on Debian’s nodejs, consider the official binaries until a fix lands.

What about Java?

Oracle’s October 2026 Critical Patch Update came out on 20 October. Press reports count 55 Java SE fixes, most of them exploitable over the network. The highest score is 7.5, so nothing is rated critical. Upgrade to 8u511, 11.0.33, 17.0.21, 21.0.13 or 25.0.5. In addition, Oracle issued a separate alert, CVE-2026-91403, about distrusting the eMudhra intermediates. That alert lists even these new builds as affected, so watch for a follow-up update.

Quick checklist

• ☐ Every Node install found: servers, CI runners, containers, serverless runtimes
• ☐ Updated to 22.23.4, 24.22.1 or 26.12.1
• ☐ Services restarted and containers rebuilt
• ☐ Snapshots and SEA binaries rebuilt
• ☐ Migration planned for anything on Node 20 or older

Need help keeping servers patched? See our Linux server hardening and audit service. For other issues from the same week, read our Black October fact-check.

Sources

• Node.js: October 2026 security releases
• Node.js v24.22.1 release notes
• The Hacker News: researchers demonstrate Node2Shell RCE
• Debian security tracker: CVE-2026-111497
• Oracle Critical Patch Update, October 2026
• Oracle Security Alert CVE-2026-91403

Want a second pair of eyes on your DevOps security? Our VAPT services cover CI/CD pipelines, self-hosted tools and how secrets are stored. For servers, see our Linux server hardening & security audit, or contact us.