Node.js ships security fixes across 22.x/24.x/26.x, worst bug allows RCE
dotey · x · 2026-10-22
On Oct 21 Node.js released security updates for all maintained lines: 22.x → v22.23.4, 24.x → v24.22.1, 26.x → v26.12.1, fixing multiple high-severity issues. EOL lines 20.x and 25.x get no patches.
- Brotli decompressor out-of-bounds write: can lead to remote code execution; fixed by syncing an upstream Google Brotli change.
- HTTPS cert validation bypasses (2 high, 1 medium): full-width digit IPs (e.g. "１２７") and loosely parsed malformed IPs could bypass address verification; Node now rejects malformed IPs. Full-width issue affects only 24.x/26.x.
- dns.resolve high-severity: a NUL character in a hostname truncates the lookup to the prefix.
- Medium: with startup snapshots or single-executable apps (SEA), crypto.randomUUID()/randomInt() caches get baked in, producing identical "random" values on every launch.
More from coding & agent
- Nous Research ships official Hermes Agent plugin for Meshy AI 3D generation via MCP — NousResearch · 2026-10-22
- Support AI Regurgitating Stale Docs Is a Growing Failure Mode — Give It Real Platform View — joshwhiton · 2026-10-22
- CallBaba launches BabaBench, a benchmark testing AI agents on real patient advocacy tasks — mattturck · 2026-10-22
- 70%-95% failure rates: devs say AI agents still too unreliable for real workflows — Luke17man · 2026-10-22
- How do you actually test agents before production? Devs tackle failure-path testing — Last-Bluejay-4443 · 2026-10-22
- A Reddit long-read proposes the Risk and Judgement pattern for bounding agent autonomy — mostly_deterministic · 2026-10-22