Node.js Security Update (October 2026): CVE-2026-111497
On 21 October 2026, the Node.js project released security updates for its 22.x, 24.x and 26.x lines: Node.js 22.23.4, 24.22.1 and 26.12.1. They fix 10 vulnerabilities, and the highest severity is High. The most serious, CVE-2026-111497, is an out-of-bounds write in the Brotli decoder that can allow remote code execution. Update Node.js, then restart every Node.js application so it runs the new version.