Node.js released security updates for versions 26.x, 24.x, and 22.x on October 21, 2026, addressing four high-severity vulnerabilities including remote code execution via the Brotli decoder, TLS certificate hostname bypasses, and DNS NUL character truncation. The releases also update dependencies such as c-ares, ca-cert, OpenSSL, SQLite, and Undici to patch known public vulnerabilities.
Background
Node.js regularly publishes security releases to address vulnerabilities discovered in the runtime and its dependencies. These updates are critical for production systems running affected versions.
- Source
- Lobsters
- Published
- Oct 21, 2026 at 11:53 PM
- Score
- 8.0 / 10