Node.js advisories

Advisories for the Node.js runtime itself: security releases, TLS and HTTP parsing bugs, and how to roll out fixes.

CriticalVulnerabilityPatch available

Node.js October 2026 security release: Brotli RCE now exploited, plus TLS hostname bypasses

Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten CVEs, including a Brotli decoder flaw now on CISA’s exploited list and three TLS certificate checks.

21 Oct 2026CVE-2026-111497, CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073Node.js

CriticalVulnerabilityPatch available

Rejetto HFS CVE-2026-61500: an AI-found bug attacked the day after its write-up

A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.

1 Oct 2026CVE-2026-61500Node.js npm Open source