Node.js Multiple Vulnerabilities

Node.js Multiple Vulnerabilities

Release Date: 22 Oct 2026

Multiple vulnerabilities have been identified in Node.js. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, security restriction bypass, sensitive information disclosure and remote code execution on the targeted system.

---

Impact

• Denial of Service
• Remote Code Execution
• Information Disclosure
• Security Restriction Bypass

---

System / Technologies affected

• Node.js versions prior to 22.23.4 (LTS)
• Node.js versions prior to 24.22.1 (LTS)
• Node.js versions prior to 26.12.1 (Current)

---

Solutions

Before installation of the software, please visit the vendor web-site for more details.

• Update to Node.js version 22.23.4 (LTS)
• Update to Node.js version 24.22.1 (LTS)
• Update to Node.js version 26.12.1 (Current)

---

Vulnerability Identifier

• CVE-2026-105481
• CVE-2026-105482
• CVE-2026-105483
• CVE-2026-106069
• CVE-2026-106070
• CVE-2026-106071
• CVE-2026-106072
• CVE-2026-106073
• CVE-2026-106074
• CVE-2026-111497

---

Source

• Node.js

---

Related Link

• https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• https://nodejs.org/en/blog/release/v22.23.4
• https://nodejs.org/en/blog/release/v24.22.1
• https://nodejs.org/en/blog/release/v26.12.1