The Node.js release of October 21, 2026 fixed ten CVEs in versions 26.12.1, 24.22.1 and 22.23.4: four rated high, three medium and three low, with Node.js 26.x hit by all ten, 24.x by eight and 22.x
Three of the four high-rated flaws sit in Brotli decoding, TLS hostname checks and dns.resolve, so services that connect out or accept untrusted input should upgrade first, and Node.js 20 and older
CVE-2026-106074 caches random-number entropy inside startup snapshots and single executable applications, so those artifacts must be rebuilt with the fixed Node.js version, not only upgraded.