Node.js, 21 Oct 2026: CVE-2026-105482 (high) truncates names passed to dns.resolve when they contain a NUL. It affects 26.x, 24.x, and 22.x. The fix validates null bytes in 26.12.1, 24.22.1, and 22.23.4.
21 Oct 2026 Node security release: CVE-2026-106069 (high) bypasses TLS hostname checks when a host loosely resolves to an IP. It affects 26, 24, and 22. The same-day fullwidth-digit issue CVE-2026-105483 is listed only for 26.x and 24.x.
Node.js, 21 Oct 2026: CVE-2026-111497 is high. A Brotli decoder out-of-bounds write can permit remote code execution. It affects 26.x, 24.x, and 22.x, fixed in 26.12.1, 24.22.1, and 22.23.4.
