The post is mostly accurate. On October 21, 2026, Node.js shipped security releases for its 22, 24 and 26 lines that fix ten vulnerabilities, four of them rated high, according to Security Online's write-up and heise's coverage.
The most serious is CVE-2026-111497, an out-of-bounds write in the Brotli decoder that can allow remote code execution. It matters most for applications that decompress untrusted Brotli content. The public summaries don't spell out the exact conditions needed to exploit it, so I wouldn't assume every server is equally exposed.
The other high-severity items are two flaws that can let a connection accept a certificate for the wrong hostname (one is CVE-2026-106069), and a DNS flaw where dns.resolve truncates names containing a NUL character (CVE-2026-105482). Heise also reports that the update removes the compromised certificate authority eMudhra from Node's built-in certificate store.
The fixed versions are 22.23.4, 24.22.1 and 26.12.1. Node 18 and 20 are end-of-life and get no patch, as the post says. Check with node --version, update, and rebuild any Docker images that bundle Node.
🕒 As of October 2026
