Node.js Fixes 10 Flaws, 4 High, on the Same Day as PHP

The Node.js Project shipped security releases on 21 October 2026 that fix 10 vulnerabilities in the runtime, four of them rated high, according to its security-release post. The fixed versions are Node.js 22.23.4, 24.22.1 and 26.12.1, and the post says “The highest severity issue fixed in this release is HIGH.”

The releases were published on GitHub at 10:38 UTC. The PHP security team had set 14:00 UTC the same day for its fixes to two critical flaws, about three hours later (our arithmetic). Node.js is the JavaScript runtime used to run many web servers and developer tools, so operators faced two major patch releases in one day.

Business Pill · EMBEDDED DEPENDENCY

A short Business Engineer explainer on embedded dependencies: the components inside the things you buy or run. It teaches the general idea only and says nothing about Node.js or any vulnerability.

What Node.js Fixed

The post lists 10 CVE entries, the public IDs used to track security flaws: four rated high, three medium and three low. It says updates are “available for the 26.x, 24.x, 22.x Node.js release lines.”

One high-rated item, CVE-2026-111497, is titled “Node.js Brotli decoder out-of-bounds write permits remote code execution.” Remote code execution means an attacker could get a server to run code of their choosing over the network. Brotli is a compression format used to shrink web traffic. The post says this flaw affects all three supported lines.

Two other high-rated items are TLS certificate hostname bypasses, CVE-2026-105483 and CVE-2026-106069. TLS certificate verification is the check that a secure connection is really talking to the server it says it is. The fourth high-rated item, CVE-2026-105482, is titled “dns.resolve truncates names containing NUL char.”

The same release also updates several components that Node.js bundles from other projects: c-ares, the ca-cert store over an “eMudhra Intermediate CA Compromise,” OpenSSL, SQLite and Undici, the post says.

What Was Posted on X

Mark Gadala-Maria’s post on 21 October, which drew about 40,000 views, says 10 security flaws were addressed in that day’s Node.js release, four rated high, including a Brotli remote code execution flaw, and urges users to update to 22.23.4, 24.22.1 or 26.12.1. His counts match the Node.js Project’s post; the word emergency and the Docker advice are his. This piece uses the post as the report that spread the story on X.

Which Versions Are Affected

The post says the highest severity issue fixed in each of the 26.x, 24.x and 22.x lines is high. Not every flaw touches every line: the fullwidth-digits TLS bypass, for example, “affects Node.js 26.x and 24.x.”

Older lines get no fix. The post says: “It’s important to note that End-of-Life versions are always affected when a security release occurs.” The Node.js release schedule lists end-of-life dates of 30 April 2025 for Node.js 18 and 30 April 2026 for Node.js 20.

For administrators, the practical step in the post is to move to a supported version: it asks users to “please use an up-to-date version as outlined in our Release Schedule.” In plain terms, a server on Node.js 22, 24 or 26 needs the new point release, and a server on 18 or 20 needs a move to a supported line.

What the Viral Post Got Right

The story spread on X through a post by Mark Gadala-Maria at 17:11 UTC that drew about 40,000 views. Its core numbers match the Node.js post: it says “10 SECURITY FLAWS were addressed in today’s Node.js release, FOUR rated HIGH severity,” names the Brotli remote code execution flaw by its CVE ID, and lists the same three fixed versions.

One word is his, not the project’s. He wrote that “Node.js 22, 24 and 26 all required emergency security updates.” The Node.js post does not call the releases an emergency; it describes scheduled security releases for those lines “on or shortly after, Wednesday, October 21, 2026.” His advice to rebuild and redeploy Docker containers is his own, not in the Node.js post.

The Node.js post credits each flaw to a named reporter and a named fixer by their project user names. It does not say whether any of the 10 flaws were found with AI tools.

Connecting the Coverage

PHP’s fixes were due the same afternoon. In our PHP preview piece, we reported that the PHP security team set its release for 14:00 UTC on 21 October, with two critical flaws each rated 9.2 on the CVSS v4.0 scale. We also reported that Cloudflare’s chief technology officer wrote that it was “seeing early attacks emerging.”

AI tools were credited with the PHP finds. In our piece on how they were found, security firm Wiz said AI models, including Google’s Gemini 4 Argon, helped its researchers find them. In our piece on AI security finds, we reported that Anthropic says Claude flagged 493 issues across 25 open-source projects, and that OpenAI says security firm Calif found a critical PHP flaw using GPT-5.6 Sol.

And the same day, OpenAI published a policy blueprint titled “Democratic governance of frontier AI, part II: Empowering cyber defenders.” It says: “We are in a defender’s window: a limited opportunity to put advanced AI into defenders’ hands and strengthen protections before advanced cyber offensive capabilities become widely available.” OpenAI says its proposals draw on “misalignment and security incidents involving our own models.” The blueprint does not name specific incidents; one OpenAI published the day before is the agent case in our monitoring piece.

What’s new here: a second widely used web runtime shipped a batch of high-severity fixes on the same day, with no AI credit in its own disclosure.

The Structural Read

As we read it, the release reaches every supported line: the Node.js post says the highest severity issue fixed in each of 26.x, 24.x and 22.x is high.

As we read it, the gap is in older servers: the post says “End-of-Life versions are always affected when a security release occurs,” and the release schedule lists Node.js 20 as end-of-life since 30 April 2026.

As we read it, unlike the PHP finds, which Wiz and OpenAI credited partly to AI models, this disclosure carries no AI credit: the Node.js post names each reporter and fixer and does not say whether AI tools were used.

Three Implications

FOR TEAMS RUNNING NODE.JS 22, 24 OR 26 The Node.js post lists the fixed versions as 22.23.4, 24.22.1 and 26.12.1.

FOR TEAMS STILL ON NODE.JS 18 OR 20 The release schedule lists end-of-life dates of 30 April 2025 and 30 April 2026, and the post asks users to “please use an up-to-date version as outlined in our Release Schedule.”

FOR THE AI SECURITY DEBATE OpenAI wrote on the same day: “We are in a defender’s window: a limited opportunity to put advanced AI into defenders’ hands and strengthen protections before advanced cyber offensive capabilities become widely available.”

The Business Engineer Lens

This story maps onto the Business Engineer framework Enterprise AI: From Software to Substrate.

The framework argues that enterprise vendors now “sell irreversibility,” and puts it in one line: “The product is the interconnection.”

As we read it, a runtime like Node.js is that kind of substrate: the release patches five components it carries from other projects, and every application built on it inherits the update. The framework was published in December 2025 and does not discuss Node.js.

What Is Not Established

The Node.js post does not say whether any of the flaws were exploited before the fix, and it does not give severity scores beyond the high, medium and low ratings. The sources we read do not say how the flaws were found.

Neither project’s post links the two releases. We did not contact the Node.js Project.

The Bottom Line

The Node.js Project fixed 10 vulnerabilities on 21 October 2026, four rated high, including a Brotli flaw that it says permits remote code execution, in Node.js 22.23.4, 24.22.1 and 26.12.1. End-of-life versions such as Node.js 18 and 20 get no fix, so the project’s advice is to run a supported line.