Node.js Security Releases 26.12.1, 24.22.1 and 22.23.4: Fixed Lines and Rated Items

Fixed releases for each line, and the missing affected range #

Each nodejs.org page names one release for its line. Those are the releases the pages describe as containing the listed changes. The affected-version column below is empty in the sources, so it reads "Not stated" for every line.

All three nodejs.org pages carry the date 2026-10-21 and name @aduh95 as the author line. The 26.12.1 page and the GitHub release page for 26.12.1 both say the release was prepared by @RafaelGSS. Each nodejs.org page links to platform binaries, installers, source archives and a documentation directory, and each includes a SHASUMS block with SHA256 entries.

Because the sources give no affected range, they cannot tell a reader whether an earlier build on any line is vulnerable. They establish only the named fixed release for each line and the changes each page lists.

Rated items on the nodejs.org notable lists #

The table below compares the rated items in the notable-changes list of each nodejs.org page. A dash means the item is not in that page's notable list. Item names are shortened.

The 26.12.1 page lists eight rated items: four High, two Medium and two Low. The 24.22.1 page lists seven: four High, two Medium and one Low, with no zlib item. The 22.23.4 page lists six: three High, two Medium and one Low, with no TLS IP normalization regression item.

High-rated items #

The four High-rated items on the 26.12.1 page cover TLS IP address handling, DNS input validation and a Brotli dependency change. The 24.22.1 page carries the same four High items. The 22.23.4 page rates three of them High and omits the TLS IP normalization regression item from its notable list.

The 26.12.1 notable list attributes the Brotli cherry-pick to Evgenii Kliuchnikov. The same cherry-pick appears in the commit lists of all three pages. The sources do not describe the conditions under which any of these items affects a deployment, so this article does not supply them.

Medium and Low-rated items #

The HTTP item about the agent data guard and the crypto item about random caches across snapshots are each rated Medium on all three nodejs.org pages. The sources do not describe the behaviour behind either rating.

The zlib item, which concerns caching invalid ZIP local headers, is rated Low on the 26.12.1 page only. The permission item about checking the permission model in realpathSync is rated Low on all three pages.

The GitHub copy of 26.12.1 lists more rated items #

The GitHub release page for 26.12.1 has the same release date and title as the nodejs.org page, but its notable list differs. It includes "src: expose BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH", attributed to Antoine du Hamel and rated High. It also includes "src: fix the fs permission tree node on wildcard nodes", attributed to James M Snell and rated Low. On the nodejs.org 26.12.1 page, both of these items appear only in the commit list.

Counting rated items on the GitHub notable list gives ten: five High, two Medium and three Low. The nodejs.org 26.12.1 notable list gives eight. The two commit-only items account for the difference. A reader who compares the two copies by count alone will therefore see different totals.

The GitHub page also prints CVE-2026-106071 next to the zlib item. The nodejs.org 26.12.1 page does not print that identifier.

Unrated entries and version bumps #

Several notable entries carry no severity label. On the 26.12.1 page these include the V8 backport from commit 93cd21e8254b, the root certificate update to NSS 3.131.1, the rejection of chains that contain blocked public keys, the c-ares update to 1.34.9, the Gatekeeper retry after notarization and the X.509 conversion hardening.

The dependency entries differ by line. The 24.22.1 notable list names timezone 2026e, OpenSSL sources at openssl-3.5.9 and undici 7.30.1. The 22.23.4 notable list names timezone 2026e, OpenSSL sources at openssl-3.5.9, sqlite 3.53.4 and undici 6.29.1. The 26.12.1 notable list does not name undici, but its commit list names undici 8.12.2. The undici entries name different major lines on different pages, and the sources do not say why.

The 26.12.1 commit list also contains a revert titled "module: synchronously load most ES modules". The 24.22.1 and 22.23.4 pages do not show that entry.

CVE identifiers and what the pages leave unmapped #

The pages print CVE identifiers in parentheses near the items. The layout does not state which identifier belongs to which item, so this article does not map them. The list below records only what each page prints.

• The 26.12.1 release page prints CVE-2026-106069, CVE-2026-106072, CVE-2026-105482, CVE-2026-105483, CVE-2026-111497, CVE-2026-105481, CVE-2026-106074, CVE-2026-106070 and CVE-2026-106073.
• The 24.22.1 release page prints CVE-2026-106069, CVE-2026-106072, CVE-2026-105482, CVE-2026-105483, CVE-2026-111497, CVE-2026-105481, CVE-2026-106074 and CVE-2026-106073.
• The 22.23.4 release page prints CVE-2026-106069, CVE-2026-106072, CVE-2026-105482, CVE-2026-111497, CVE-2026-105481, CVE-2026-106074 and CVE-2026-106073.

Protection steps supported by the sources #

1. Move each Node.js installation to the release named for its line: 26.12.1 for the 26 line, 24.22.1 for the 24 line and 22.23.4 for the 22 line. The pages describe these as the releases that contain the listed changes. The sources describe no other mitigation.
2. Obtain the files from the release page for that line. The 26.12.1 page links to platform binaries and to https://nodejs.org/dist/v26.12.1/ for other release files, and the 24.22.1 and 22.23.4 pages follow the same pattern for their own versions.
3. Compare each downloaded file's SHA256 digest with the entry for the same file name in the SHASUMS block on the same release page before installing it.
4. Read the notable-changes list for your line. If you use the GitHub copy of 26.12.1, also read the two items it rates that the nodejs.org 26.12.1 notable list omits. The sources do not describe how any item applies to a particular configuration.

How readers can check whether they are affected #

The sources do not state an affected version range, and they do not describe how to read the runtime version on a host or in a container. A reader can compare the version a deployment reports with the fixed release named for its line. A deployment on a release below that named release is not on the release that carries these changes. The sources do not say whether any earlier release is vulnerable.

To check a downloaded archive, compare its SHA256 digest with the matching entry in the SHASUMS block. A match shows that the file agrees with the value the release page publishes. It does not show that a host has been updated, and it does not show whether a rated item applies to a given workload.

For exposure to individual items, the sources offer only the severity labels and the notable-changes lists. The sources do not describe the affected configurations for TLS, DNS, Brotli, HTTP, crypto, zlib or permission behaviour, so readers must rely on their own configuration and on the release pages.