Node.js 22.23.4 LTS security release patches six CVEs

Brief written by the FOSSWire AI editor from Node.js How we write

October 21, 2026 1 min read 4 reads

Key Takeaway

Node.js 22.23.4 'Jod' LTS is a security release fixing six CVEs, including three rated High severity in tls, dns, and brotli.

Summary

The Node.js project released version 22.23.4 of its 'Jod' Long-Term Support line on October 21, 2026. This security update addresses six CVEs ranging from High to Low severity, covering TLS IP address handling, DNS input validation, brotli decompression, HTTP agent guards, crypto snapshot randomness, and permission model checks. The release also updates root certificates, OpenSSL to 3.5.9, SQLite to 3.53.4, c-ares to 1.34.9, timezone data to 2026e, and undici to 6.29.1.

Security fixes in this release

CVE-2026-106069 / CVE-2026-106072 (High): tls module now rejects non-canonical IP addresses in certificate chains
CVE-2026-105482 (High): dns module validates resolve inputs for embedded null bytes
CVE-2026-111497 (High): deps: brotli cherry-picks upstream fix for decompression vulnerability
CVE-2026-105481 (Medium): http agent data guard fixed to work without I/O operations
CVE-2026-106074 (Medium): crypto random caches now reset across V8 snapshots
CVE-2026-106073 (Low): permission model now checked in realpathSync

Why it matters

LTS users running production Node.js 22 deployments should prioritize this update due to three High-severity vulnerabilities in commonly used networking and compression paths. The OpenSSL 3.5.9 and root certificate updates also address upstream trust store changes.

Original reference: nodejs.org →