Node.js published security releases on 21 October 2026 for its 22.x, 24.x and 26.x lines. If your application uses one of those runtimes, check the deployed version and schedule the update. The official security announcement covers ten vulnerabilities, with a highest severity of High.
Choose the patch for your release line
The releases published that day are:
- Node.js 22: 22.23.4, an LTS security release.
- Node.js 24: 24.22.1, an LTS security release.
- Node.js 26: 26.12.1, a Current security release.
Use the appropriate patched release, or a later version confirmed to include these fixes. A security patch within your existing supported line is usually easier to validate than a major-version migration. If you use a distribution package or managed runtime, check its security notice for the patch status.
Understand the exposure before choosing the tests
Brotli decompression needs attention where an application processes compressed input from another system. CVE-2026-111497 can corrupt process memory and may allow remote code execution when vulnerable Node.js code decompresses attacker-controlled Brotli data. It affects 22.x, 24.x and 26.x. This is one specific exposure path; it does not mean every Node.js HTTP endpoint is directly exploitable. See the Brotli section of the advisory.
The same announcement describes DNS and TLS hostname-validation problems, HTTP keep-alive response handling, random-value caches preserved in startup snapshots and single executable applications, ZIP validation, and filesystem permission checks. These are different failure paths. Review the APIs your service uses so the update tests cover relevant behavior.
Update the runtime that actually serves traffic
Start with an inventory of the API process, queue workers, scheduled jobs, build environment and container images. Updating the Node.js installation on a developer laptop leaves the production deployment untouched. Updating npm dependencies also leaves the runtime executable in place.
For a service deployed from a container, rebuild the image with the patched runtime, run its checks and replace the running instances. For a single executable application, rebuild the executable with the patched toolchain. If you generate startup snapshots, include those artifacts in the rebuild and review their random-value initialization.
Before rollout, check the flows that rely on outbound HTTPS, DNS resolution, compression and background jobs. Keep a record of the image or build identifier you tested. After rollout, verify that every instance has moved to that artifact.
Verify the running version
From the deployed environment, a basic version check is:
node --version
node -p 'JSON.stringify({node:process.version,exe:process.execPath})'
These commands describe the executable they launch. Run them inside the relevant deployment image or service environment. A shell on the host can use a different Node.js installation from the application process. The Node.js command-line documentation describes the version and print options.
When a vendor backports a fix, retain its security notice alongside the package version. A short version string alone may not establish whether that package contains the patch.
Keep the Permission Model in perspective
This release also fixes filesystem Permission Model issues. Patching those issues does not turn the feature into a sandbox for hostile code. The official Permission Model documentation states that it restricts trusted code's access to resources and does not guarantee protection against malicious code.
For code you do not trust, make isolation a separate deployment decision. Do not use a successful permission check as evidence that executing an unknown package is safe.
Close the maintenance task when the deployed runtimes are patched, old instances have stopped and the application checks pass. Record any remaining vendor dependency explicitly so a package update is not mistaken for a completed rollout.