Node.js 26.12.1 fixes nine security flaws, including five rated High

The Node.js project released version 26.12.1, a security update for the Current release line. It addresses nine CVEs: five rated High severity in TLS IP address handling, DNS input validation, and the Brotli dependency; two Medium severity issues in HTTP agent data guards and crypto snapshot random cache behavior; and two Low severity flaws in zlib ZIP header caching and permission model checks. The release also updates root certificates to NSS 3.131.1, backports a V8 fix, and updates c-ares to 1.34.9.

What the nine CVEs affect

• CVE-2026-106069 / CVE-2026-106072: TLS now rejects non-canonical IP addresses, preventing certificate validation bypasses
• CVE-2026-105482: DNS resolve inputs are validated for null bytes, closing a potential injection vector
• CVE-2026-105483: TLS IP normalization regression fixed, restoring correct address comparison behavior
• CVE-2026-111497: Brotli dependency patched via upstream cherry-pick for decompression vulnerability
• CVE-2026-105481: HTTP agent data guard now functions correctly without requiring I/O operations
• CVE-2026-106074: Crypto random caches are reset across V8 snapshots, preventing state leakage
• CVE-2026-106070: Zlib no longer caches invalid ZIP local headers, avoiding potential memory issues
• CVE-2026-106073: Permission model is now checked in realpathSync, closing a sandbox escape path
• Additional hardening: X.509 conversion and formatting strengthened; root certificates updated to NSS 3.131.1

Why it matters

Production deployments on Node.js 26.x should prioritize this update due to the concentration of High-severity TLS and DNS vulnerabilities. The revert of synchronous ES module loading may affect startup performance characteristics for some applications.