Is your Node.js affected by the October 2026 security release?
Paste a Node.js version, a Docker image or a whole Dockerfile. Each one gets a clear verdict, the CVEs that apply and the exact image to switch to.
- 22.x needs 22.23.4
- 24.x needs 24.22.1
- 26.x needs 26.12.1
This tool reads version numbers you give it. It doesn’t scan images or servers. Confirm every verdict with node -v on the running service before closing a finding. Read the caution notes.
Paste node -v output, or name each service like orders-api: v22.11.0.
One image per line, or paste a Dockerfile and every FROM line is checked.
Runs entirely in your browser. Nothing you paste is sent anywhere.
What the release fixes
Ten CVEs across the three supported lines: four high, three medium and three low. A struck-through line isn’t affected by that CVE.
- HighCVE-2026-111497
Brotli decoder out-of-bounds write, possible remote code execution
22.x24.x26.x - HighCVE-2026-105483
TLS hostname bypass when the IP is written in fullwidth digits
22.x24.x26.x - HighCVE-2026-106069
TLS hostname bypass when the host loosely resolves to an IP address
22.x24.x26.x - HighCVE-2026-105482
dns.resolvetruncates names containing a NUL character22.x24.x26.x - MediumCVE-2026-105481
Keep-alive socket processes a response written before the request was sent
22.x24.x26.x - MediumCVE-2026-106072
DNS SANs can authenticate non-canonical IPv4 endpoints
22.x24.x26.x - MediumCVE-2026-106074
crypto.randomUUID()andrandomInt()repeat values in startup snapshots and SEAs22.x24.x26.x - LowCVE-2026-106070
ZipFile returns attacker-controlled prefix bytes after a failed header check
22.x24.x26.x - LowCVE-2026-106071
Permission Model filesystem over-grant via wildcard lookup
22.x24.x26.x - LowCVE-2026-106073
Permission Model bypass with
fs.realpathSync22.x24.x26.x
The release also updates bundled dependencies: c-ares and Undici on all three lines, the CA certificate store on all three (eMudhra intermediate CA compromise), OpenSSL on 24.x and 22.x, and SQLite on 22.x.
Find the Node.js version your service runs
Check what’s actually running, not what package.json says.
Inside a container or server
node -vEvery pod in an OpenShift or Kubernetes namespace
Replace NS with your namespace. Use kubectl in place of oc on plain Kubernetes. Paste the output into the version tab.
for p in $(oc get pods -n NS -o jsonpath='{.items[*].metadata.name}'); do echo "$p: $(oc exec -n NS $p -- node -v 2>/dev/null || echo n/a)"; doneAll images deployed in the cluster
Paste the list into the image tab.
oc get pods -A -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort -uA built image, without deploying it
docker run --rm --entrypoint node IMAGE -vIf you’re affected
- Upgrade to
22.23.4,24.22.1or26.12.1in your Dockerfile, CI images and build agents. - Rebuild every application and container image. A new Node.js on the host doesn’t fix an image that’s already built.
- Check the deployed runtime with
node -vand run it through this checker again. - Deploy internet-facing services and anything that decompresses untrusted Brotli content first.
- Run regression and security tests before production.
- If you can’t upgrade yet, record a risk assessment and the compensating controls you’ve put in place.
Caution
- A tag isn’t proof. Images can be retagged, pinned by digest, or copy a Node.js binary in from another stage. Only
node -von the running service is conclusive. - Distribution packages use their own versions. Node.js from
apt,apk,dnfor Red Hat UBI may carry backported fixes under a different version number, and may use the system OpenSSL. Follow your vendor’s security advisory for those. - End-of-life lines stay vulnerable. The Node.js project treats end-of-life versions as always affected by a security release. Node.js 18, 20, 21, 23 and 25 won’t get these fixes.
- “Not affected” covers this release only. It means the version includes the 21 October 2026 fixes. Earlier or later advisories may still apply.
- Your npm dependencies are separate. Upgrading Node.js updates its bundled Undici, but an
undicipackage your app installs from npm needs its own update. - This is a triage aid, not a security assessment. It’s provided as is, with no warranty. Your security team’s risk assessment and the official advisory take precedence.
Sources
Version and CVE data checked against the official advisory on 22 October 2026.
- Node.js: Wednesday, October 21, 2026 Security ReleasesOfficial advisory. Primary source for every CVE, affected line and patched version on this page.
- Node.js v22.23.4 release notesPatched release for the 22.x line.
- Node.js v24.22.1 release notesPatched release for the 24.x line.
- Node.js v26.12.1 release notesPatched release for the 26.x line.
- Node.js release scheduleWhich lines are supported and which are end-of-life.
- Node.js security policyHow vulnerabilities are reported and announced.
- Cyber Security News: Node.js releases security updatesSecondary news coverage. Not used for version data.
Questions
Is node:22-alpine safe?
Only if the image was pulled after the fix shipped. Floating tags like node:22 or node:lts point to the newest release at pull time, so older builds still carry an affected version. Rebuild with --pull and pin node:22.23.4-alpine or later.
What about Node.js 18, 20, 23 or 25?
The Node.js project treats end-of-life versions as always affected, and no fix will ship. Move to 22.23.4, 24.22.1 or 26.12.1.
We use Red Hat UBI or distroless images. What changes?
Those image names fix the major version and the tag is a build number. Pull the newest build, confirm node -v reports a patched version, then pin it by digest.
Does this page send my data anywhere?
No. Everything runs in your browser.