CVE-2026-106072

Breaking 🚨 - Node.js October 2026 Security Releases – High severity fixes available now!

Security updates are out for the supported Node.js lines: 26.x, 24.x, and 22.x.

Highest severity is HIGH. Key issues include: • TLS non-canonical IP address handling (CVE-2026-106069 / CVE-2026-106072)

• DNS resolve null-byte validation (CVE-2026-105482)

• TLS IP normalization regression (CVE-2026-105483)

• Brotli decoder issues (CVE-2026-111497) Plus several Medium and Low severity fixes (HTTP agent, crypto snapshots, zlib, permissions, etc.).

Upgrade immediately to the latest patched versions on your release line. End-of-life versions (20.x and earlier) are not patched.

Full details on @nodejs blog: https://t.co/LMA1Xf4vQ7 #NodeJS #Security #CVE #InfoSec