Introduction

The National Cyber Security Agency (NACSA), through the National Cyber Coordination and Command Centre (NC4), highlights multiple high-severity vulnerabilities, identified as CVE-2026-111497, CVE-2026-105482, CVE-2026-105483 and CVE-2026-106069, have been addressed in Node.js security updates released on 21 October 2026.

These vulnerabilities affect the Node.js 22.x, 24.x and 26.x release lines, with the specific impact varying by version. Successful exploitation may result in remote code execution, TLS certificate hostname validation bypass or improper DNS handling.

Impact

Successful exploitation may allow attackers to:

• Execute malicious code through a vulnerable Brotli decoder.
• Bypass TLS certificate hostname verification, potentially enabling server impersonation.
• Manipulate DNS resolution through specially crafted hostnames.
• Compromise the confidentiality, integrity and availability of affected applications.

The impact depends on how an application uses the vulnerable functionality and whether attackers can reach it.

System Affected

Applications, servers and containers running affected Node.js versions prior to the following security-fixed releases:

Note: CVE-2026-105483 affects Node.js 24.x and 26.x only. The other three listed vulnerabilities affect all three release lines.

Recommendation

How to check

1. Identify servers, applications and containers running Node.js.
2. Check the installed Node.js version using the command node -v.
3. Compare installed versions against the relevant security-fixed releases.
4. Verify Node.js versions used in production, development and CI/CD environments.
5. Review application and security logs for unusual behaviour or suspicious activities.

Recommended actions

1. Immediately update affected Node.js installations to the relevant fixed versions or newer supported security releases.
2. Rebuild and redeploy affected application containers where necessary.
3. Conduct application compatibility and security testing after applying updates.
4. Restrict unnecessary application exposure and apply appropriate security controls.
5. Continue monitoring affected applications for suspicious activities.

Note: Active exploitation of these vulnerabilities has not been confirmed in the official Node.js security announcement.

References

Node.js - Wednesday, October 21, 2026 Security Releases    https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

Node.js - Version 22.23.4 (LTS) Security Release    https://nodejs.org/en/blog/release/v22.23.4/

Node.js - Version 24.22.1 (LTS) Security Release    https://nodejs.org/en/blog/release/v24.22.1/

Node.js – Version 26.12.1 (Current) Security Release    https://nodejs.org/en/blog/release/v26.12.1/