# Node.js 26.12.1 fixes nine security flaws, including five rated High

> **Key takeaway:** Node.js 26.12.1 is a security release patching nine CVEs, five of them High severity, affecting TLS, DNS, HTTP, crypto, and zlib components.

**Published:** 2026-10-21T10:39:20+00:00 
**Source:** Node.js Official Releases 
**Category:** software-engineering 
**Canonical URL:** https://fosswire.org/news/nodejs-26121-fixes-nine-security-flaws-including-five-rated-.html 

## Summary
The Node.js project released version 26.12.1, a security update for the Current release line. It addresses nine CVEs: five rated High severity in TLS IP address handling, DNS input validation, and the Brotli dependency; two Medium severity issues in HTTP agent data guards and crypto snapshot random cache behavior; and two Low severity flaws in zlib ZIP header caching and permission model checks. The release also updates root certificates to NSS 3.131.1, backports a V8 fix, and updates c-ares to 1.34.9.

## What the nine CVEs affect
- **CVE-2026-106069 / CVE-2026-106072**: TLS now rejects non-canonical IP addresses, preventing certificate validation bypasses
- **CVE-2026-105482**: DNS `resolve` inputs are validated for null bytes, closing a potential injection vector
- **CVE-2026-105483**: TLS IP normalization regression fixed, restoring correct address comparison behavior
- **CVE-2026-111497**: Brotli dependency patched via upstream cherry-pick for decompression vulnerability
- **CVE-2026-105481**: HTTP agent data guard now functions correctly without requiring I/O operations
- **CVE-2026-106074**: Crypto random caches are reset across V8 snapshots, preventing state leakage
- **CVE-2026-106070**: Zlib no longer caches invalid ZIP local headers, avoiding potential memory issues
- **CVE-2026-106073**: Permission model is now checked in `realpathSync`, closing a sandbox escape path
- **Additional hardening**: X.509 conversion and formatting strengthened; root certificates updated to NSS 3.131.1

## Why it matters
Production deployments on Node.js 26.x should prioritize this update due to the concentration of High-severity TLS and DNS vulnerabilities. The revert of synchronous ES module loading may affect startup performance characteristics for some applications.