Node.js October 2026 Security Releases: alt-nodejs Updates for CloudLinux (CVE

Node.js published security releases on October 21, 2026 that fix 10 vulnerabilities, with a highest severity of High. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that upstream says can allow remote code execution. No CVSS scores had been published at the time of writing.

Affected: Node.js Selector ( alt-nodejs packages) and ea-nodejs22 (cPanel) on CloudLinux, plus the TuxCare, Debian, Ubuntu, and Alpine builds, on every Node.js line CloudLinux ships, including end-of-life versions. Upstream notes that end-of-life versions are always affected by security releases.

Mitigation: none documented upstream. Updating the system brotli package does not help, because alt-nodejs packages carry their own copy of Brotli. See Is there a mitigation? .

Fix status: fixed packages are released for CloudLinux for alt-nodejs12 , alt-nodejs14 , alt-nodejs16 , alt-nodejs18 , alt-nodejs20 , alt-nodejs24 , and alt-nodejs26 on all platforms, and for alt-nodejs22 on CloudLinux 8 and 9 and Ubuntu 22.04. In total, 31 of 33 CloudLinux builds and 76 of 99 TuxCare builds are released. ea-nodejs22 is released for CloudLinux 8 with hardened ea-php. Still pending: alt-nodejs22 for CloudLinux 7 and the standard EasyApache 4 build of ea-nodejs22 , whose releases have not completed, and the TuxCare builds marked pending in the tables below. The remaining packages are expected by 17:30 to 17:45 UTC.

Verify: after updating, check each installed alt-nodejs package's release against the minimum fixed release. End-of-life lines keep their Node.js version, so node --version will not change for them. See How to verify you are patched .

Status page: follow the CloudLinux status page incident for release notices.

Node.js released v22.23.4, v24.22.1, and v26.12.1 on October 21, 2026. Together they fix 10 CVEs across the HTTP, DNS, TLS, crypto, and permission-model code, plus the Brotli decoder. Four are rated High, three Medium, and three Low.

CloudLinux ships Node.js to hosting accounts through Node.js Selector, as alt-nodejs packages. A fix from nodejs.org therefore reaches your accounts only when we rebuild those packages and you install them. The same applies to ea-nodejs22 (cPanel) and to the TuxCare, Debian, Ubuntu, and Alpine builds.

Why this matters on a shared host

On a shared server the Node.js version belongs to each account’s application, not to you. Anyone who can send that application data it will decode, parse, or validate can reach the runtime underneath it. The High-rated issues cover the Brotli decoder, DNS name handling, and TLS hostname checks, so exposure depends on what each application does with network input.

Upstream does not patch end-of-life Node.js lines, and those are the versions most likely to sit forgotten on older accounts. CloudLinux is building updated packages for the end-of-life versions it ships as well.

Which versions are affected?

Every Node.js line in the CloudLinux repositories is affected. The table shows where each line stands.

Debian, Ubuntu, and Alpine builds are listed per package. The CloudLinux column covers Ubuntu 22.04. Platforms marked on the way are still being built.

Which of the 10 CVEs apply depends on the line. Three affect only some lines: CVE-2026-106070 and CVE-2026-106071 apply to 26.x only, and CVE-2026-105483 applies to 26.x and 24.x. The full list is in the section on what the releases fix.

Is there a mitigation?

No workaround for CVE-2026-111497 is documented upstream. The fix is the updated package.

Updating the system brotli package does not fix it. alt-nodejs packages carry their own copy of Brotli, so only an updated alt-nodejs package closes the issue.

Until the fixed package for your Node.js line is available, the practical way to limit exposure to the Brotli issue is to avoid decoding Brotli data from sources you do not control. That means reviewing applications that fetch compressed content from third-party servers or accept compressed uploads. This reduces risk and does not remove it.

Fixed packages are available for alt-nodejs12 , alt-nodejs14 , alt-nodejs16 , alt-nodejs18 , alt-nodejs20 , alt-nodejs24 , and alt-nodejs26 on CloudLinux, and for alt-nodejs22 on CloudLinux 8 and 9. The tables above list the platforms each one covers. alt-nodejs22 for CloudLinux 7 and the standard EasyApache 4 build of ea-nodejs22 (CloudLinux 8) are not yet released, and the remaining packages are expected by 17:30 to 17:45 UTC. ea-nodejs22 (cPanel) is available for CloudLinux 8 with hardened ea-php.

Fixed packages go straight to the stable repositories, so no testing-channel step is needed. CageFS does not need a manual update.

Running applications keep using the old binary until they restart. After updating, restart the Node.js applications on each account, either from Node.js Selector or with:

How to verify you are patched

End-of-life lines keep their upstream Node.js version, so node --version does not change after the update. Check the package release instead:

The package is fixed if its release is at least the value in the table.

On the supported lines, the Node.js version also reads v22.23.4, v24.22.1, or v26.12.1 or later once the package is fixed.