Security updates are now available for the 26.x, 24.x, and 22.x Node.js release lines, addressing several public vulnerabilities.
One identified issue in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This incomplete fix for CVE-2026-48930 permits an attacker to resolve attacker.example\0.trusted.example queries as attacker.example, potentially causing applications that validate hostnames against a domain allowlist to act on records for an unintended name. This flaw impacts Node.js versions 26.x, 24.x, and 22.x.
Another security concern involves Node.js TLS hostname verification, where a certificate lacking a matching IP address SAN can authenticate a connection to an IPv4 address if the host uses non-ASCII characters, such as fullwidth digits (１２７.0.0.1). This regression, following the fix for CVE-2026-48618, affects Node.js 26.x and 24.x, allowing a certificate with DNS:127.0.0.1 or DNS:*.0.0.1 to be accepted for an IP endpoint for which it was not issued.
Furthermore, a flaw in Node.js TLS hostname verification permits a server certificate to validate against a different IP address than the connected endpoint when the host is a non-canonical IPv4 literal with a leading zero, like 0127.0.0.1. This occurs because tls.checkServerIdentity() normalizes the host differently across the WHATWG URL rules and the operating system resolver, affecting Node.js 26.x, 24.x, and 22.x.
A vulnerability within the Brotli decoder bundled with Node.js enables malformed compressed input to write beyond an internal decoder buffer. An attacker supplying such data to an application using node:zlib could corrupt process memory, potentially leading to remote code execution or memory disclosure. This affects Node.js 26.x, 24.x, and 22.x.
In Node.js HTTP Agent connection reuse, an incomplete fix for CVE-2026-48931 allows a client to accept a response sent prior to the client initiating its request. This happens if an unsolicited response reaches the socket before the event loop polls for I/O, causing the data to be parsed as the response for the subsequent request. This issue affects 26.x, 24.x, and 22.x.
A third TLS hostname verification weakness allows a certificate with only a DNS SAN to authenticate an IP endpoint when connecting with a non-canonical IPv4 spelling, such as 0177.0.0.1. tls.checkServerIdentity() normalizes these hosts, matching the result against the certificate's DNS names, which can be exploited if the certificate has a numeric DNS SAN and no IP Address:127.0.0.1 SAN. This affects Node.js 26.x, 24.x, and 22.x.
Other security flaws include one in the Node.js crypto module where internal entropy caches used by functions like crypto.randomUUID() can be saved into user-land startup snapshots. This results in predictable identifiers across processes built from that snapshot, affecting 26.x, 24.x, and 22.x. Separately, the Node.js zlib.ZipFile API can return bytes outside the requested entry after header validation fails, affecting Node.js 26.x.
Additionally, Node.js Permission Model filesystem enforcement has two issues: one where a path shorter than a wildcard grant prefix is treated as a match, and another where fs.realpathSync() lacks required read permission checks, allowing access outside permitted directories. These affect Node.js 26.x.
These security patches are released by the Node.js project on or shortly after Wednesday, October 21, 2026, with the highest severity issue fixed being HIGH. The availability of these updates underscores the ongoing operational necessity for infrastructure operators to maintain current software versions against evolving threats.
