The Node.js project released security updates on October 21 for every supported branch of the JavaScript runtime, addressing 10 vulnerabilities in Node.js and refreshing bundled components that carry their own security fixes. Maintainers are directing users to versions 22.23.4, 24.22.1 or 26.12.1, depending on the release line already deployed.
Four of the Node.js flaws are rated high severity. Two concern the verification of certificates used in TLS connections, while another affects DNS name resolution. A fourth vulnerability involves the runtime's Brotli compression decoder and could allow remote code execution when an attacker disrupts decoding with malicious input.
The releases also incorporate newer versions of dependencies, including OpenSSL and SQLite. Updating bundled software matters because applications can remain exposed through a component even when their own code is unchanged. Administrators therefore need to treat the release as a broader runtime refresh rather than a patch for a single isolated bug.
Certificate trust is another focus of the update. Node.js has changed its built-in certificate store to block the compromised certificate authority eMudhra. It now also carries a blocklist for intermediate certificates, giving the runtime a way to reject a TLS chain containing revoked public keys even when the root authority remains trusted. That protection is designed for incidents in which distrust needs to be applied below the root level.
The supported targets span the 22.x, 24.x and 26.x branches. Users on Node.js 22 should move to 22.23.4, those on 24 should install 24.22.1, and deployments on 26 should upgrade to 26.12.1. Older, end-of-life branches are also affected but will not receive equivalent fixes. Systems still using those branches need to migrate to a maintained line rather than waiting for an update that will not arrive.
For production operators, the range of affected functions makes prompt testing and deployment important. TLS and DNS handling sit on common network paths, while Brotli is widely used to compress web content and other transferred data. Internet-facing services, developer platforms and internal tools built on Node.js may all exercise one or more of those code paths.
Teams should inventory runtime versions across servers, containers, continuous-integration workers and developer systems, then test the applicable release against their applications before rolling it out. Rebuilding container images is especially important because updating a host installation does not automatically replace a runtime embedded in an existing image. After deployment, operators can verify the active Node.js version and retire obsolete artifacts so vulnerable instances are not restored later.
The fixes reinforce that maintaining Node.js requires attention both to the runtime's own code and to the libraries distributed with it. A supported release line provides the channel through which both types of defect are corrected.
