Node.js October 21, 2026 Security Releases

[DeOccultist]

It's time to update your node.js on your XO instances.

Updates are now available for the 26.x, 24.x, 22.x Node.js release lines for the following issues.

This security release includes the following dependency updates to address public vulnerabilities:

c-ares on 26.x, 24.x, 22.x
ca-cert (eMudhra Intermediate CA Compromise) on 26.x, 24.x, 22.x
OpenSSL on 24.x, 22.x
SQLite on 22.x
Undici on 26.x, 24.x, 22.x

dns.resolve truncates names containing NUL char (CVE-2026-105482) - (high)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.

TLS certificate hostname bypass when the IP is written fullwidth digits (CVE-2026-105483) - (high)
This vulnerability affects Node.js 26.x and 24.x.

Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.

TLS certificate hostname bypass when the host loosely resolves to an IP address (CVE-2026-106069) - (high)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to anagnorisis2peripeteia for reporting this vulnerability and thank you mcollina for fixing it.

Node.js Brotli decoder out-of-bounds write permits remote code execution (CVE-2026-111497) - (high)

A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to mcollina for reporting this vulnerability and thank you aduh95 for fixing it.

Keep-alive socket process a response that was written before the request was sent (CVE-2026-105481) - (medium)

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to hasanfleyah for reporting this vulnerability and thank you jasnell for fixing it.

Improper certificate validation for non-canonical IPv4 hostnames allows DNS SANs to authenticate IP endpoints (CVE-2026-106072) - (medium)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to br41ny for reporting this vulnerability and thank you mcollina for fixing it.

crypto.randomUUID() and randomInt() entropy caches are saved into user-land startup snapshots and SEAs, so every process repeats the same values (CVE-2026-106074) - (medium)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to gesposito for reporting this vulnerability and thank you panva for fixing it.

Node.js ZipFile returns attacker-controlled prefix bytes after failed ZIP header validation (CVE-2026-106070) - (low)

This vulnerability affects Node.js 26.x.

Thank you, to startimeash for reporting this vulnerability and thank you mcollina for fixing it.

Permission Model filesystem over-grant via wildcard radix lookup (CVE-2026-106071) - (low)
This vulnerability affects Node.js 26.x.

Thank you, to malikhamzaiqbal for reporting this vulnerability and thank you jasnell for fixing it.

Permission Model bypass with fs.realpathSync (CVE-2026-106073) - (low)
This vulnerability affects Node.js 26.x, 24.x, and 22.x.

Thank you, to 0xoroot for reporting this vulnerability and thank you RafaelGSS for fixing it.

Downloads and release details

Node.js v22.23.4
Node.js v24.22.1
Node.js v26.12.1

Summary

The Node.js project will release new versions of the 26.x, 24.x, 22.x releases lines on or shortly after, Wednesday, October 21, 2026 in order to address security vulnerabilities.

The highest severity issue fixed in this release is HIGH.
Impact

The highest severity issue fixed in the 26.x release line is HIGH.
The highest severity issue fixed in the 24.x release line is HIGH.
The highest severity issue fixed in the 22.x release line is HIGH.

https://nodejs.org/en/blog/vulnerability/october-2026-security-releases

[poddingue]

Thanks for the heads-up.

If you built XO from sources, the docs say to keep Node on the latest LTS (https://docs.xen-orchestra.com/getting-started/install-from-sources#nodejs), so it's worth moving to the patched release on whichever line you run.

For XOA, I don't know how fast the appliance picks up a new Node release, but I know something's cooking.

[willamcorlin]

@poddingue Thanks for sharing this. For those running Xen Orchestra from sources, is there a recommended way to verify which Node.js version is actually being used by the running services after upgrading? I'm also curious whether anyone has heard when the patched Node.js version will be included in a new XOA appliance release.

[Danp]

@willamcorlin

node -v is the simplest means to check the running version of Node. AFAIK, the next update to XOA will include the patched Node version.

[acebmxer]

@willamcorlin,

If you are using my installer script (https://github.com/acebmxer/install_xen_orchestra), there are two quick ways to verify the active Node.js version. @poddingue can you confirm this is correct?

1. During the Update/Install Process
The script explicitly pulls the active environment version and prints it out against your NODE_VERSION target in the logs:

❯ node -v
v24.22.1

[INFO] Node.js v24.22.1 satisfies configured version 24 — no runtime change needed
[INFO] Installing Node.js 24...
[INFO] Node.js 24 requirement satisfied (installed: v24.22.1)

2. Verifying the Live Service Runtime
To be absolutely certain that the running systemd daemon is executing the correct binary instance after a restart, you can check the status of the xo-server unit:

sudo systemctl status xo-server.service

Look at the CGroup line in the output. It maps directly to the active path and flags (such as the heap memory allocations set by the script):

CGroup: /system.slice/xo-server.service
        └─18540 /usr/bin/node --max-old-space-size=5410 /opt/xen-orchestra/packages/xo-server/dist/cli.mjs

You can then run /usr/bin/node -v (or whatever path is reflected there) to double-check that the active service binary is indeed on the patched release line (v24.22.1, v22.23.4, etc.).

[poddingue]

@acebmxer I haven't run your script, so I can't vouch for the log lines, but the systemctl status check looks like the safer of the two to me. It shows the binary the service is really running. Whichever node comes first in your shell can be a different one if more than one Node is installed. For XOA I'd go with what @Danp said above.