# Node.js 22.23.4 LTS security release patches six CVEs

> **Key takeaway:** Node.js 22.23.4 'Jod' LTS is a security release fixing six CVEs, including three rated High severity in tls, dns, and brotli.

**Published:** 2026-10-21T10:39:12+00:00 
**Source:** Node.js Official Releases 
**Category:** software-engineering 
**Canonical URL:** https://fosswire.org/news/nodejs-22234-lts-security-release-patches-six-cves.html 

## Summary
The Node.js project released version 22.23.4 of its 'Jod' Long-Term Support line on October 21, 2026. This security update addresses six CVEs ranging from High to Low severity, covering TLS IP address handling, DNS input validation, brotli decompression, HTTP agent guards, crypto snapshot randomness, and permission model checks. The release also updates root certificates, OpenSSL to 3.5.9, SQLite to 3.53.4, c-ares to 1.34.9, timezone data to 2026e, and undici to 6.29.1.

## Security fixes in this release
- **CVE-2026-106069 / CVE-2026-106072 (High)**: `tls` module now rejects non-canonical IP addresses in certificate chains
- **CVE-2026-105482 (High)**: `dns` module validates resolve inputs for embedded null bytes
- **CVE-2026-111497 (High)**: `deps: brotli` cherry-picks upstream fix for decompression vulnerability
- **CVE-2026-105481 (Medium)**: `http` agent data guard fixed to work without I/O operations
- **CVE-2026-106074 (Medium)**: `crypto` random caches now reset across V8 snapshots
- **CVE-2026-106073 (Low)**: `permission` model now checked in `realpathSync`

## Why it matters
LTS users running production Node.js 22 deployments should prioritize this update due to three High-severity vulnerabilities in commonly used networking and compression paths. The OpenSSL 3.5.9 and root certificate updates also address upstream trust store changes.