Skip to content
Multiple High-Severity CVEs Addressed in Node.js Releases

Multiple High-Severity CVEs Addressed in Node.js Releases

First seen 22 Oct 2026, 09:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 10:12 UTC
  • •Node.js versions 22.23.4, 24.22.1, and 26.12.1 have critical vulnerabilities patched.
  • •CVE-2026-106069 and CVE-2026-106072 involve high-severity flaws in TLS handling.
  • •Immediate updates are recommended to protect against potential exploitation.

Node.js has released updates for versions 22.23.4, 24.22.1, and 26.12.1 to address multiple high-severity vulnerabilities. Key issues include CVE-2026-106069 and CVE-2026-106072, which involve rejecting non-canonical IP addresses, and CVE-2026-105482, which pertains to DNS input validation for null bytes. The vulnerabilities could potentially allow attackers to exploit the affected systems, which include various Node.js versions. The updates also include fixes for other issues related to TLS, HTTP, and crypto functionalities. Users are advised to update their installations promptly to mitigate risks. The patches were released on October 21 and 22, 2026, and are crucial for maintaining the security of applications built on Node.js.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-21
Node.js 24.22.1 released
Node.js released version 24.22.1 addressing multiple high-severity vulnerabilities including CVE-2026-106069 and CVE-2026-106072.
Node.js
2026-10-22
Node.js 22.23.4 and 26.12.1 released
Node.js released versions 22.23.4 and 26.12.1, also fixing high-severity vulnerabilities including CVE-2026-106069 and CVE-2026-106072.
Node.js
2026-10-22
CVE-2026-106069 and CVE-2026-106072 disclosed
The vulnerabilities were disclosed as part of the Node.js updates, highlighting critical issues in TLS handling.
Node.js
2026-10-22
Public exploit for CVE-2026-111497 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-10-22
Public exploit for CVE-2026-105482 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub

More articles in this cluster (3)

Following this threat?

Track CVE-2026-105481 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 2

Common questions

Which Node.js versions are affected?
Versions 22.23.4, 24.22.1, and 26.12.1 are affected by the vulnerabilities.
What vulnerabilities were disclosed?
CVE-2026-106069 and CVE-2026-106072 are high-severity vulnerabilities related to TLS handling.
How urgent is the patching?
Patching is urgent as the vulnerabilities could be exploited, and updates are available.