Sudo has finished upgrading Node.js to the latest security patches across all of its systems, fixing the series of vulnerabilities that the Node.js project disclosed in its emergency security release of October 2026.
This release fixes 10 different security vulnerabilities and applies to the 22.x, 24.x and 26.x release lines at once. Four of them are rated High, including one that can lead to remote code execution (RCE). The patches also update the core libraries bundled with Node.js, such as OpenSSL, SQLite, c-ares and Undici.
Customers using services managed by Sudo do not need to take any action. This article summarizes the vulnerabilities, what Sudo has done, and recommendations for customers who manage their own servers.
Critical vulnerabilities disclosed
The most severe is CVE-2026-111497 in the Brotli decoder: an attacker only needs to send malicious compressed data to cause a memory leak or remote code execution.
| CVE ID | Severity | Description | Affected versions |
|---|---|---|---|
| CVE-2026-111497 | High | Out-of-bounds write in the Brotli decoder; malicious compressed data can cause a memory leak or remote code execution (RCE). | 22.x, 24.x, 26.x |
| CVE-2026-105482 | High | dns.resolve truncates domain names that contain a NUL character, which can be abused to redirect traffic or bypass DNS checks. | 22.x, 24.x, 26.x |
| CVE-2026-105483 | High | TLS certificate hostname verification bypass when an IP address is written with fullwidth digits. | 24.x, 26.x |
| CVE-2026-106069 | High | TLS certificate hostname verification bypass when the target host is loosely resolved to an IP address. | 22.x, 24.x, 26.x |
| CVE-2026-105481 | Medium | A keep-alive socket processes a response that was written before the request was sent. | 22.x, 24.x, 26.x |
| CVE-2026-106072 | Medium | Incorrect certificate validation for non-canonical IPv4 hostnames, allowing a DNS SAN to authenticate an IP endpoint. | 22.x, 24.x, 26.x |
| CVE-2026-106074 | Medium | The entropy buffer of crypto.randomUUID() and randomInt() is stored in the startup snapshot, so processes generate the same random values. | 22.x, 24.x, 26.x |
| CVE-2026-106073 | Low | Permission Model bypass via fs.realpathSync. | 22.x, 24.x, 26.x |
Beyond the vulnerabilities above, the release also patches the core dependencies OpenSSL, SQLite, c-ares and Undici.
What Sudo has updated
As soon as the patches were released, Sudo's engineering team upgraded every Node.js environment on its systems to the official safe versions.
| Node.js release line | Updated version |
|---|---|
| 26.x | v26.12.1 |
| 24.x (LTS) | v24.22.1 |
| 22.x (LTS) | v22.23.4 |
The upgrade was rolled out step by step and checked for compatibility, with no disruption to customer services. Customers can check the running version with node -v.
Recommendations for customers who manage their own servers
If you installed Node.js yourself on a VPS, dedicated server or container, upgrade right away with the following steps:
- Check the current version with
node -v. - Upgrade to the matching patch release: v22.23.4, v24.22.1 or v26.12.1.
- If you use Docker, update the Node.js image tag in your Dockerfile, then rebuild and redeploy.
- Restart the application (PM2, systemd…) so the process runs on the new version.
Note: Node.js 23.x and 25.x have reached end of life (EOL) and do not receive patches for these vulnerabilities. If you are using these versions, you should move to the 24.x LTS line or upgrade to 26.x.
Some cloud platforms have enabled WAF rules to block known Brotli exploit patterns, but upgrading the runtime remains the most thorough fix.
Sudo closely follows security advisories and proactively applies updates so that customer systems run safely and reliably. If you need help checking or upgrading Node.js, please contact the Sudo engineering team for guidance.
