Node.js 26.12.1, 24.22.1 and 22.23.4 Fix 10 CVEs in TLS, DNS and Brotli

The Ten October CVEs, Their Severity and the Lines They Affect #

The security post rates each CVE and names the affected lines, and the 26.12.1 release notes put the CVE in front of the commit that fixes it, for example "(CVE-2026-105482) dns: validate resolve inputs for null bytes". Node.js publishes severity labels, not CVSS scores. The CVE records list every 22.x release up to 22.23.3, 24.x up to 24.22.0 and 26.x up to 26.12.0 as affected where the line is named.

The same releases update dependencies for public vulnerabilities: c-ares and Undici on all three lines, OpenSSL on 24.x and 22.x, SQLite on 22.x, and the CA certificates on all three lines for the eMudhra intermediate CA compromise. The 26.12.1 notes also list "tls: reject chains containing blocked public keys" and the move to NSS 3.131.1 root certificates.

Three TLS Hostname Checks That Accepted the Wrong IP Address #

Three CVEs make tls.checkServerIdentity() accept a certificate for an IP address it was not issued for, each through a different spelling of the address:

• CVE-2026-106069 (high): a leading-zero octet such as 0127.0.0.1 is read as octal by the hostname check, so it becomes 87.0.0.1, while some operating system resolvers, macOS among them, connect to 127.0.0.1. The certificate is checked against one address and the connection goes to another.
• CVE-2026-105483 (high, 26.x and 24.x): fullwidth digits such as １２７.0.0.1 were not recognized as an IP address, so a certificate with DNS:127.0.0.1 or DNS:*.0.0.1 matched. The post calls it a regression introduced after the fix for CVE-2026-48618.
• CVE-2026-106072 (medium): spellings such as 0x7f.0.0.1, 2130706433 or 127.1 let a certificate with only a DNS SAN authenticate an IP endpoint. It needs a trusted certificate with a numeric DNS SAN and a resolver that accepts these spellings, such as glibc.

All three only matter when a client connects to a host written as a non-canonical IP literal. A client that connects by DNS name is outside them.

DNS Truncation, Brotli Memory Corruption and Keep-Alive Responses #

CVE-2026-105482 is an incomplete fix of CVE-2026-48930, which covered dns.lookup() and the net and tls host options but not dns.resolve*() and dns.reverse(). Because the name goes to c-ares as a C string, resolving attacker.example\0.trusted.example returns the records of attacker.example without an error. An application that checks a hostname against an allowlist and then resolves it with dns.resolve*() acts on a different name than the one it checked.

In CVE-2026-111497, an invalid block switch in Brotli data was reported as a need for more input instead of a format error, so the streaming decoder kept writing past an eight-byte internal buffer. An application that decompresses attacker-supplied Brotli data with node:zlib can crash, disclose process memory or, according to the post, execute attacker code. The CVE record, from Google, scores the Brotli flaw 9.2 under CVSS 4.0 and lists Brotli 1.0.3 through 1.2.0 as affected, and CISA's SSVC assessment of October 23 rates exploitation as active. The post credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with the report.

CVE-2026-105481 is an incomplete fix of CVE-2026-48931. The HTTP Agent destroys an idle keep-alive socket when unexpected data arrives, but only while the event loop polls for I/O. If a server's unsolicited response is already waiting on the socket when the Agent hands it to a new request, for example after a stretch of synchronous work, the client parses it as the response to that request.

Repeated UUIDs From Snapshots and Three Low-Severity Fixes #

CVE-2026-106074 affects user-land startup snapshots built with --build-snapshot and single executable applications built with useSnapshot. If crypto.randomUUID(), crypto.randomUUIDv7(), crypto.randomInt() or an API that uses them, such as URL.createObjectURL(), runs while the snapshot is built, their entropy caches are saved with it. Every process started from that snapshot then returns the same values until the cache refills: up to 127 UUIDs and about 1,000 randomInt() values. The fix stops the caches from being saved, so a snapshot or single executable built with an older release has to be built again.

The three low-severity CVEs concern features fewer applications use. CVE-2026-106070, on 26.x only, makes zlib.ZipFile return attacker-controlled bytes after a failed header check, so a scanner can approve content that another ZIP tool extracts differently. CVE-2026-106071 lets a wildcard Permission Model grant such as --allow-fs-read=/etc/passwd.* also allow /etc/passwd, a different root cause from the earlier CVE-2026-58043. CVE-2026-106073, an incomplete fix of CVE-2026-21715, left fs.realpathSync() without the read permission check, so code under --permission could probe paths outside its grants.

Upgrading Node.js and Rebuilding What Embeds It #

1. Install the newest release of the line in use: 26.12.1, 24.22.1 and 22.23.4 carry the October fixes, and the later security releases include them. The security posts note that end-of-life lines are always affected when a security release ships, so a server on an older line has no fixed release.
2. Rebuild container images, startup snapshots built with --build-snapshot and single executable applications after the upgrade, because each carries the Node.js binary it was built with, and a snapshot built before 26.12.1, 24.22.1 or 22.23.4 keeps its saved random caches.
3. Until the upgrade, do not decompress Brotli data from untrusted sources with node:zlib, and reject hostnames that contain a NUL byte before resolving them.
4. Give TLS clients IP literals only in canonical form, such as 127.0.0.1, never with leading zeros, hexadecimal octets or fullwidth digits.
5. On 22.x and 24.x with the Permission Model, avoid a wildcard --allow-fs-read or --allow-fs-write grant as the only grant for its scope until a release that fixes CVE-2026-106071 on that line is installed.

Checking a Node.js Service for the Affected Versions and APIs #

The version decides most of this; any 22.x before 22.23.4, 24.x before 24.22.1 or 26.x before 26.12.1 lacks the October fixes. The search finds the APIs the CVEs above depend on, so a team can see which ones its own services reach.

node --version
grep -rnE "dns\.(resolve|reverse)|createBrotliDecompress|brotliDecompress|build-snapshot|useSnapshot|randomUUID|allow-fs-(read|write)" --include="*.js" --include="*.mjs" --include="*.cjs" --include="*.ts" --include="*.json" .