📋 TL;DR — last updated 2026-10-22 16:54 UTC

Node.js published security releases on October 21, 2026 that fix 10 vulnerabilities, with a highest severity of High. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that upstream says can allow remote code execution. No CVSS scores had been published at the time of writing.

  • Affected: Node.js Selector (alt-nodejs packages) and ea-nodejs22 (cPanel) on CloudLinux, plus the TuxCare, Debian, Ubuntu, and Alpine builds, on every Node.js line CloudLinux ships, including end-of-life versions. Upstream notes that end-of-life versions are always affected by security releases.
  • Mitigation: none documented upstream. Updating the system brotli package does not help, because alt-nodejs packages carry their own copy of Brotli. See Is there a mitigation?.
  • Fix status: fixed packages are released for CloudLinux for alt-nodejs12, alt-nodejs14, alt-nodejs16, alt-nodejs18, alt-nodejs20, alt-nodejs24, and alt-nodejs26 on all platforms, and for alt-nodejs22 on CloudLinux 8 and 9 and Ubuntu 22.04. In total, 31 of 33 CloudLinux builds and 76 of 99 TuxCare builds are released. ea-nodejs22 is released for CloudLinux 8 with hardened ea-php. Still pending: alt-nodejs22 for CloudLinux 7 and the standard EasyApache 4 build of ea-nodejs22, whose releases have not completed, and the TuxCare builds marked pending in the tables below. The remaining packages are expected by about 17:30 to 17:45 UTC.
  • Verify: after updating, check each installed alt-nodejs package's release against the minimum fixed release. End-of-life lines keep their Node.js version, so node --version will not change for them. See How to verify you are patched.
  • Status page: follow the CloudLinux status page incident for release notices.

Node.js released v22.23.4, v24.22.1, and v26.12.1 on October 21, 2026. Together they fix 10 CVEs across the HTTP, DNS, TLS, crypto, and permission-model code, plus the Brotli decoder. Four are rated High, three Medium, and three Low.

CloudLinux ships Node.js to hosting accounts through Node.js Selector, as alt-nodejs packages. A fix from nodejs.org therefore reaches your accounts only when we rebuild those packages and you install them. The same applies to ea-nodejs22 (cPanel) and to the TuxCare, Debian, Ubuntu, and Alpine builds.

Status page. Release notices for this issue are posted on the CloudLinux status page incident. Subscribe to the status page to be notified when each package ships.

 

Why this matters on a shared host

On a shared server the Node.js version belongs to each account’s application, not to you. Anyone who can send that application data it will decode, parse, or validate can reach the runtime underneath it. The High-rated issues cover the Brotli decoder, DNS name handling, and TLS hostname checks, so exposure depends on what each application does with network input.

Upstream does not patch end-of-life Node.js lines, and those are the versions most likely to sit forgotten on older accounts. CloudLinux is building updated packages for the end-of-life versions it ships as well.

 

Which versions are affected?

Every Node.js line in the CloudLinux repositories is affected. The table shows where each line stands.

Node.js lineAffectedStatus
26.x, 24.x, 22.x
Supported upstream; fixed in v26.12.1, v24.22.1, and v22.23.4		❌ Yes✅ alt-nodejs24 and alt-nodejs26 released for CloudLinux 8 and 9
✅ alt-nodejs22 released for CloudLinux 8 and 9
⏳ alt-nodejs22 for CloudLinux 7: release not yet complete
12.x, 14.x, 16.x, 18.x, 20.x, 23.x
End-of-life lines shipped by CloudLinux		❌ Yes✅ alt-nodejs12, alt-nodejs14, and alt-nodejs16 released for CloudLinux 7, 8, and 9
✅ alt-nodejs18 released for CloudLinux 7, 8, 9, and 7h
✅ alt-nodejs20 released for CloudLinux 7, 8, and 9
⏳ alt-nodejs23: in preparation, expected by about 17:45 UTC
ea-nodejs22 (cPanel)❌ Yes✅ Released for CloudLinux 8 with hardened ea-php
⏳ Standard EasyApache 4 build for CloudLinux 8: release not yet complete
TuxCare builds❌ Yes✅ alt-nodejs12 and alt-nodejs14 released for CloudLinux 6, 7, 8, 9, and 10
✅ alt-nodejs16, alt-nodejs18, and alt-nodejs20 released for CloudLinux 7, 8, 9, and 10
✅ alt-nodejs22, alt-nodejs24, and alt-nodejs26 released for CloudLinux 8, 9, and 10
⏳ nodejs 16 for AlmaLinux ESU 9.2, 9.6, and 9.8: pending

Debian, Ubuntu, and Alpine builds are listed per package. The CloudLinux column covers Ubuntu 22.04. Platforms marked on the way are still being built.

PackageTuxCareCloudLinux (Ubuntu 22.04)
alt-nodejs12✅ Debian 10, 11, 12, and 13; Ubuntu 18.04, 20.04, 22.04, and 24.04✅ Released
alt-nodejs14✅ Debian 10 and 13; Ubuntu 20.04 and 22.04; Alpine 3.23 and 3.24
⏳ Debian 11 and 12 and Ubuntu 18.04 and 24.04: released at 16:46 UTC, reaching the public repository within about 10 minutes		✅ Released
alt-nodejs16✅ Debian 10, 11, 12, and 13; Ubuntu 18.04, 20.04, 22.04, and 24.04; Alpine 3.23 and 3.24✅ Released
alt-nodejs18✅ Debian 10, 11, 12, and 13; Ubuntu 18.04, 20.04, 22.04, and 24.04; Alpine 3.23 and 3.24✅ Released
alt-nodejs20✅ Ubuntu 18.04, 20.04, 22.04, and 24.04
⏳ Debian 10, 11, 12, and 13: pending		✅ Released
alt-nodejs22✅ Debian 11, 12, and 13; Ubuntu 20.04, 22.04, 24.04, and 26.04✅ Released
alt-nodejs23⏳ Debian 12 and 13 and Alpine: pendingNone listed
alt-nodejs24⏳ Debian 12 and 13; Ubuntu 22.04, 24.04, and 26.04: pending✅ Released
alt-nodejs26⏳ Debian 13; Ubuntu 24.04 and 26.04: pendingNone listed

Which of the 10 CVEs apply depends on the line. Three affect only some lines: CVE-2026-106070 and CVE-2026-106071 apply to 26.x only, and CVE-2026-105483 applies to 26.x and 24.x. The full list is in the section on what the releases fix.

 

Is there a mitigation?

No workaround for CVE-2026-111497 is documented upstream. The fix is the updated package.

Updating the system brotli package does not fix it. alt-nodejs packages carry their own copy of Brotli, so only an updated alt-nodejs package closes the issue.

Until the fixed package for your Node.js line is available, the practical way to limit exposure to the Brotli issue is to avoid decoding Brotli data from sources you do not control. That means reviewing applications that fetch compressed content from third-party servers or accept compressed uploads. This reduces risk and does not remove it.

 

Update history

Live from our status page · Current status: … View on status page →

Loading updates…

Update instructions

Fixed packages are available for alt-nodejs12, alt-nodejs14, alt-nodejs16, alt-nodejs18, alt-nodejs20, alt-nodejs24, and alt-nodejs26 on CloudLinux, and for alt-nodejs22 on CloudLinux 8 and 9. The tables above list the platforms each one covers. alt-nodejs22 for CloudLinux 7 and the standard EasyApache 4 build of ea-nodejs22 (CloudLinux 8) are not yet released, and the remaining packages are expected by about 17:30 to 17:45 UTC. ea-nodejs22 (cPanel) is available for CloudLinux 8 with hardened ea-php.

Fixed packages go straight to the stable repositories, so no testing-channel step is needed. CageFS does not need a manual update.

# See which alt-nodejs packages are installed
rpm -qa 'alt-nodejs*'

# Update them
yum update 'alt-nodejs*'

Running applications keep using the old binary until they restart. After updating, restart the Node.js applications on each account, either from Node.js Selector or with:

cloudlinux-selector restart --json --interpreter nodejs --user <user> --app-root <app_root>

 

How to verify you are patched

End-of-life lines keep their upstream Node.js version, so node --version does not change after the update. Check the package release instead:

rpm -q alt-nodejs16

The package is fixed if its release is at least the value in the table.

PackageMinimum fixed release
alt-nodejs1235
alt-nodejs1437
alt-nodejs1633
alt-nodejs1826
alt-nodejs2015
alt-nodejs222
alt-nodejs2323
alt-nodejs242
alt-nodejs261

On the supported lines, the Node.js version also reads v22.23.4, v24.22.1, or v26.12.1 or later once the package is fixed.

The rest of this advisory is background for readers who want it: the full list of fixes and the dependency updates in these releases. Neither is required to apply the update above.

What the October 2026 Node.js releases fix

Severity is as rated upstream. The Node.js advisory does not publish CVSS scores or per-CVE fixed versions; it lists the three fixed releases above.

CVEIssueSeverityAffected lines
CVE-2026-111497Brotli decoder out-of-bounds write, can allow remote code executionHigh26.x, 24.x, 22.x
CVE-2026-105482dns.resolve truncates names containing a NUL characterHigh26.x, 24.x, 22.x
CVE-2026-105483TLS certificate hostname bypass when the IP is written in fullwidth digitsHigh26.x, 24.x
CVE-2026-106069TLS certificate hostname bypass when the host loosely resolves to an IP addressHigh26.x, 24.x, 22.x
CVE-2026-105481Keep-alive socket processes a response written before the request was sentMedium26.x, 24.x, 22.x
CVE-2026-106072Improper certificate validation for non-canonical IPv4 hostnames lets DNS SANs authenticate IP endpointsMedium26.x, 24.x, 22.x
CVE-2026-106074crypto.randomUUID() and randomInt() entropy caches saved into startup snapshots and single executable applications, so every process repeats the same valuesMedium26.x, 24.x, 22.x
CVE-2026-106070ZipFile returns attacker-controlled prefix bytes after failed ZIP header validationLow26.x
CVE-2026-106071Permission Model filesystem over-grant through wildcard radix lookupLow26.x
CVE-2026-106073Permission Model bypass with fs.realpathSyncLow26.x, 24.x, 22.x

The Brotli fix includes a cherry-picked upstream Brotli commit. The three TLS issues and the DNS issue matter most to applications that validate certificates for outbound connections or resolve names taken from untrusted input.

 

Dependency updates in the same releases

Alongside the CVE fixes, upstream updated bundled dependencies:

  • c-ares: 26.x, 24.x, 22.x
  • Root certificates (including a change for the eMudhra Intermediate CA compromise): 26.x, 24.x, 22.x
  • OpenSSL: 24.x, 22.x
  • SQLite: 22.x
  • Undici: 26.x, 24.x, 22.x

 

References