What happened
On 21 October 2026, Node.js fixed 10 issues across the 22.x, 24.x and 26.x lines. The highest rating is High, including a bug in the Brotli decoder that could allow code to run. Node.js notes: “End-of-Life versions are always affected when a security release occurs.” nodejs.org
Recent advisories
If your version starts with the number on the left, you need the one on the right or later.
| Advisory | Rating (vendor) | Fixed in |
|---|---|---|
| Node.js October 2026 security releasesCVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069Vendor advisorynodejs.orgPublished2026-10-21Last verified2026-10-22 (KST) | Rating (vendor) High Highest of 10 issues; 6 more rated Medium or Low | Fixed in
|
| Node.js July 2026 security releasesCVE-2026-56846, CVE-2026-56848, CVE-2026-58043Eleven fixes, including HTTP/2 issues. The October 2026 releases include them too.Vendor advisorynodejs.orgPublished2026-07-29Last verified2026-10-22 (KST) | Rating (vendor) High | Fixed in
|
How to check your version
Hosting panel
Hosting platform (PaaS): look at the runtime or Node version setting in the dashboard.
Admin screen or project files
The engines field in package.json, or the FROM node:<tag> line in your Dockerfile, names the version.
Command line
Run this on the server or in your project.
node -v
How to update
Your host or platform runs it
Platforms: change the Node version in the runtime setting (or engines in package.json) and redeploy.
You run the server
With a version manager such as nvm or Volta, install the fixed release and make it the default. Otherwise use your distribution's package or the official installer.
Docker: change the tag to a fixed release, rebuild the image and redeploy.
If your major line is not listed in the advisory, it gets no fix: plan a move to 22, 24 or 26. nodejs.org
If you can't update yet
Node.js October 2026 security releases
The Node.js advisory lists no workaround. Updating is the fix. nodejs.org
What to ask your host
Copy this, fill in the brackets and send it through your host's support channel.
Hello, my app [app name] runs on Node.js on your platform. Node.js released security updates on 21 October 2026 (22.23.4, 24.22.1 and 26.12.1). Which Node.js version does my app use, and how do I move it to one of these releases? Thank you.
Vendor sources
- Node.js October 2026 security releasesnodejs.org
- Node.js July 2026 security releasesnodejs.org
Last verified (KST)